Cell-based table manipulation of event data

ABSTRACT

A search interface is displayed in a table format that includes one or more columns, each column including data items of an event attribute, the data items being of a set of events, and a plurality of rows forming cells with the one or more columns, each cell including one or more of the data items of the event attribute of a corresponding column. Based on a user selecting one or more of the cells, a list of options if displayed corresponding to the selection, and one or more commands are added to a search query that corresponds to the set of events, the one or more commands being based on at least an option that is selected from the list of options and the event attribute for each of the one or more of the data items of each of the selected one or more cells.

BACKGROUND

Modern data centers often include thousands of hosts that operatecollectively to service requests from even larger numbers of remoteclients. During operation, components of these data centers can producesignificant volumes of machine-generated data. In order to reduce thesize of the data, it is typically pre-processed before it is stored. Insome instances, the pre-processing includes extracting and storing someof the data, but discarding the remainder of the data. Although this maysave storage space in the short term, it can be undesirable in the longterm. For example, if the discarded data is later determined to be ofuse, it may no longer be available.

In some instances, techniques have been developed to apply minimalprocessing to the data in an attempt to preserve more of the data forlater use. For example, the data may be maintained in a relativelyunstructured form to reduce the loss of relevant data. Unfortunately,the unstructured nature of much of this data has made it challenging toperform indexing and searching operations because of the difficulty ofapplying semantic meaning to unstructured data. As the number of hostsand clients associated with a data center continues to grow, processinglarge volumes of machine-generated data in an intelligent manner andeffectively presenting the results of such processing continues to be apriority. Moreover, processing of the data may return a large amount ofinformation that can be difficult for a user to interpret. For example,if a user submits a search of the data, the user may be provided with alarge set of search results for the data but may not know how the searchresults relate to the data itself or how the search results relate toone another. As a result, a user may have a difficult time decipheringwhat portions of the data or the search results are relevant to her/hisinquiry.

SUMMARY

Embodiments of the present invention are directed to cell-based tablemanipulation of event data. In accordance with aspects of the presentdisclosure, a search interface can be displayed in a table format thatincludes one or more columns and a plurality of rows forming cells withthe one or more columns. Each cell in the table format can include oneor more of the data items of an event attribute of a set of eventsutilized to populate the table format.

In various implementations, a user may select one or more of the cellsin the table format, and based on the user selection, a list of optionsis displayed that corresponds to the selected one or more cells. Thelist of options can be contextually relevant to the selection, such thatoptions are included and/or excluded from the list of options based oncontext. Furthermore, the list of options can be contextually relevantto the selection, such that options that are included may be generated,at least partially based on context. For example, one or more commandelements associated with an option may be generated based on thecontext.

Based on at least an option that is selected from the list of options bythe user, and an event attribute for each data item included in eachselected cell, one or more commands are added to a search query thatcorresponds to the set of events. In some implementations, the searchquery is automatically executed after having the one or more commandsadded thereto to provide an updated set of events. The updated set ofevents is utilized to update the table format in the search interface tocorrespond to the updated set of events. In this way, the user maydirectly interact with the table format to modify the search query andview results of the modification to effectively and efficiently generatesearch queries.

This summary is provided to introduce a selection of concepts in asimplified form that are further described below in the detaileddescription. This summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used in isolation as an aid in determining the scope of the claimedsubject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

Implementations of the present disclosure are described in detail belowwith reference to the attached drawing figures, wherein:

FIG. 1 presents a block diagram of an event-processing system inaccordance with the disclosed embodiments.

FIG. 2 presents a flowchart illustrating how indexers process, index,and store data received from forwarders in accordance with the disclosedembodiments.

FIG. 3 presents a flowchart illustrating how a search head and indexersperform a search query in accordance with the disclosed embodiments.

FIG. 4 presents a block diagram of a system for processing searchrequests that uses extraction rules for field values in accordance withthe disclosed embodiments.

FIG. 5 illustrates an exemplary search query received from a client andexecuted by search peers in accordance with the disclosed embodiments.

FIG. 6A illustrates a search screen in accordance with the disclosedembodiments.

FIG. 6B illustrates a data summary dialog that enables a user to selectvarious data sources in accordance with the disclosed embodiments.

FIG. 7A illustrates a key indicators view in accordance with thedisclosed embodiments.

FIG. 7B illustrates an incident review dashboard in accordance with thedisclosed embodiments.

FIG. 7C illustrates a proactive monitoring tree in accordance with thedisclosed embodiments.

FIG. 7D illustrates a screen displaying both log data and performancedata in accordance with the disclosed embodiments.

FIG. 8A illustrates a search screen in accordance with the disclosedembodiments.

FIG. 8B illustrates a search screen in accordance with the disclosedembodiments.

FIG. 8C illustrates a search screen in accordance with the disclosedembodiments.

FIG. 8D illustrates a search screen in accordance with the disclosedembodiments.

FIG. 8E illustrates a search screen in accordance with the disclosedembodiments.

FIG. 8F illustrates a search screen in accordance with the disclosedembodiments.

FIG. 8G illustrates events in a table format including fields extractedfrom the events.

FIG. 9 illustrates an option menu in accordance with the disclosedembodiments.

FIG. 10 illustrates command entry lists in accordance with the disclosedembodiments.

FIG. 11 illustrates a selection interface in accordance with thedisclosed embodiments.

FIG. 12 illustrates a log chat interface in accordance with thedisclosed embodiments.

FIG. 13 presents a flowchart illustrating cell-based table manipulationin accordance with the disclosed embodiments.

FIG. 14 presents a flowchart illustrating column-based tablemanipulation in accordance with the disclosed embodiments.

FIG. 15 presents a flowchart illustrating text-based table manipulationin accordance with the disclosed embodiments.

FIG. 16 presents a flowchart illustrating command entry list interactionin accordance with the disclosed embodiments.

FIG. 17 presents a flowchart illustrating enforcing dependency betweensearch queries in accordance with the disclosed embodiments.

FIG. 18 presents a flowchart illustrating distinguishing field labelsfrom multiple extractions in accordance with the disclosed embodiments.

FIG. 19 presents a flowchart illustrating extracting from extractedevent fields in accordance with the disclosed embodiments.

FIG. 20 presents a flowchart illustrating displaying at least portionsof first and second events sets in a visually distinct display format inaccordance with the disclosed embodiments.

FIG. 21 presents a flowchart illustrating suggested field extraction inaccordance with the disclosed embodiments.

DETAILED DESCRIPTION

The subject matter of embodiments of the invention is described withspecificity herein to meet statutory requirements. However, thedescription itself is not intended to limit the scope of this patent.Rather, the inventors have contemplated that the claimed subject mattermight be embodied in other ways, to include different steps orcombinations of steps similar to the ones described in this document, inconjunction with other present or future technologies. Moreover,although the terms “step” and/or “block” may be used herein to connotedifferent elements of methods employed, the terms should not beinterpreted as implying any particular order among or between varioussteps herein disclosed unless and except when the order of individualsteps is explicitly described.

1.1 Overview

Modern data centers often comprise thousands of host computer systemsthat operate collectively to service requests from even larger numbersof remote clients. During operation, these data centers generatesignificant volumes of performance data and diagnostic information thatcan be analyzed to quickly diagnose performance problems. In order toreduce the size of this performance data, the data is typicallypre-processed prior to being stored based on anticipated data-analysisneeds. For example, pre-specified data items can be extracted from theperformance data and stored in a database to facilitate efficientretrieval and analysis at search time. However, the rest of theperformance data is not saved and is essentially discarded duringpre-processing. As storage capacity becomes progressively cheaper andmore plentiful, there are fewer incentives to discard this performancedata and many reasons to keep it.

This plentiful storage capacity is presently making it feasible to storemassive quantities of minimally processed performance data at “ingestiontime” for later retrieval and analysis at “search time.” Note thatperforming the analysis operations at search time provides greaterflexibility because it enables an analyst to search all of theperformance data, instead of searching pre-specified data items thatwere stored at ingestion time. This enables the analyst to investigatedifferent aspects of the performance data instead of being confined tothe pre-specified set of data items that were selected at ingestiontime.

However, analyzing massive quantities of heterogeneous performance dataat search time can be a challenging task. A data center may generateheterogeneous performance data from thousands of different components,which can collectively generate tremendous volumes of performance datathat can be time-consuming to analyze. For example, this performancedata can include data from system logs, network packet data, sensordata, and data generated by various applications. Also, the unstructurednature of much of this performance data can pose additional challengesbecause of the difficulty of applying semantic meaning to unstructureddata, and the difficulty of indexing and querying unstructured datausing traditional database systems.

These challenges can be addressed by using an event-based system, suchas the SPLUNK® ENTERPRISE system produced by Splunk Inc. of SanFrancisco, Calif., to store and process performance data. The SPLUNK®ENTERPRISE system is the leading platform for providing real-timeoperational intelligence that enables organizations to collect, index,and harness machine-generated data from various websites, applications,servers, networks, and mobile devices that power their businesses. TheSPLUNK® ENTERPRISE system is particularly useful for analyzingunstructured performance data, which is commonly found in system logfiles. Although many of the techniques described herein are explainedwith reference to the SPLUNK® ENTERPRISE system, the techniques are alsoapplicable to other types of data server systems.

In the SPLUNK® ENTERPRISE system, performance data is stored as“events,” wherein each event comprises a collection of performance dataand/or diagnostic information that is generated by a computer system andis correlated with a specific point in time. Events can be derived from“time series data,” wherein time series data comprises a sequence ofdata points (e.g., performance measurements from a computer system) thatare associated with successive points in time and are typically spacedat uniform time intervals. Events can also be derived from “structured”or “unstructured” data. Structured data has a predefined format, whereinspecific data items with specific data formats reside at predefinedlocations in the data. For example, structured data can include dataitems stored in fields in a database table. In contrast, unstructureddata does not have a predefined format. This means that unstructureddata can comprise various data items having different data types thatcan reside at different locations. For example, when the data source isan operating system log, an event can include one or more lines from theoperating system log containing raw data that includes different typesof performance and diagnostic information associated with a specificpoint in time. Examples of data sources from which an event may bederived include, but are not limited to: web servers; applicationservers; databases; firewalls; routers; operating systems; and softwareapplications that execute on computer systems, mobile devices, andsensors. The data generated by such data sources can be produced invarious forms including, for example and without limitation, server logfiles, activity log files, configuration files, messages, network packetdata, performance measurements, and sensor measurements. An eventtypically includes a timestamp that may be derived from the raw data inthe event, or may be determined through interpolation between temporallyproximate events having known timestamps.

The SPLUNK® ENTERPRISE system also facilitates using a flexible schemato specify how to extract information from the event data, wherein theflexible schema may be developed and redefined as needed. Note that aflexible schema may be applied to event data “on the fly,” when it isneeded (e.g., at search time), rather than at ingestion time of the dataas in traditional database systems. Because the schema is not applied toevent data until it is needed (e.g., at search time), it is referred toas a “late-binding schema.”

During operation, the SPLUNK® ENTERPRISE system starts with raw data,which can include unstructured data, machine data, performancemeasurements, or other time-series data, such as data obtained fromweblogs, syslogs, or sensor readings. It divides this raw data into“portions,” and optionally transforms the data to produce timestampedevents. The system stores the timestamped events in a data store, andenables a user to run queries against the data store to retrieve eventsthat meet specified criteria, such as containing certain keywords orhaving specific values in defined fields. Note that the term “field”refers to a location in the event data containing a value for a specificdata item.

As noted above, the SPLUNK® ENTERPRISE system facilitates using alate-binding schema while performing queries on events. A late-bindingschema specifies “extraction rules” that are applied to data in theevents to extract values for specific fields. More specifically, theextraction rules for a field can include one or more instructions thatspecify how to extract a value for the field from the event data. Anextraction rule can generally include any type of instruction forextracting values from data in events. In some cases, an extraction rulecomprises a regular expression, in which case the rule is referred to asa “regex rule.”

In contrast to a conventional schema for a database system, alate-binding schema is not defined at data ingestion time. Instead, thelate-binding schema can be developed on an ongoing basis until the timea query is actually executed. This means that extraction rules for thefields in a query may be provided in the query itself, or may be locatedduring execution of the query. Hence, as an analyst learns more aboutthe data in the events, the analyst can continue to refine thelate-binding schema by adding new fields, deleting fields, or changingthe field extraction rules until the next time the schema is used by aquery. Because the SPLUNK® ENTERPRISE system maintains the underlyingraw data and provides a late-binding schema for searching the raw data,it enables an analyst to investigate questions that arise as the analystlearns more about the events.

In the SPLUNK® ENTERPRISE system, a field extractor may be configured toautomatically generate extraction rules for certain fields in the eventswhen the events are being created, indexed, or stored, or possibly at alater time. Alternatively, a user may manually define extraction rulesfor fields using a variety of techniques.

Also, a number of “default fields” that specify metadata about theevents rather than data in the events themselves can be createdautomatically. For example, such default fields can specify: a timestampfor the event data; a host from which the event data originated; asource of the event data; and a source type for the event data. Thesedefault fields may be determined automatically when the events arecreated, indexed or stored.

In some embodiments, a common field name may be used to reference two ormore fields containing equivalent data items, even though the fields maybe associated with different types of events that possibly havedifferent data formats and different extraction rules. By enabling acommon field name to be used to identify equivalent fields fromdifferent types of events generated by different data sources, thesystem facilitates use of a “common information model” (CIM) across thedifferent data sources.

1.2 Data Server System

FIG. 1 presents a block diagram of an exemplary event-processing system100, similar to the SPLUNK® ENTERPRISE system. System 100 includes oneor more forwarders 101 that collect data obtained from a variety ofdifferent data sources 105, and one or more indexers 102 that store,process, and/or perform operations on this data, wherein each indexeroperates on data contained in a specific data store 103. Theseforwarders and indexers can comprise separate computer systems in a datacenter, or may alternatively comprise separate processes executing onvarious computer systems in a data center.

During operation, the forwarders 101 identify which indexers 102 willreceive the collected data and then forward the data to the identifiedindexers. Forwarders 101 can also perform operations to strip outextraneous data and detect timestamps in the data. The forwarders nextdetermine which indexers 102 will receive each data item and thenforward the data items to the determined indexers 102.

Note that distributing data across different indexers facilitatesparallel processing. This parallel processing can take place at dataingestion time, because multiple indexers can process the incoming datain parallel. The parallel processing can also take place at search time,because multiple indexers can search through the data in parallel.

System 100 and the processes described below with respect to FIGS. 1-5are further described in “Exploring Splunk Search Processing Language(SPL) Primer and Cookbook” by David Carasso, CITO Research, 2012, and in“Optimizing Data Analysis With a Semi-Structured Time Series Database”by Ledion Bitincka, Archana Ganapathi, Stephen Sorkin, and Steve Zhang,SLAML, 2010, each of which is hereby incorporated herein by reference inits entirety for all purposes.

1.3 Data Ingestion

FIG. 2 presents a flowchart illustrating how an indexer processes,indexes, and stores data received from forwarders in accordance with thedisclosed embodiments. At block 201, the indexer receives the data fromthe forwarder. Next, at block 202, the indexer apportions the data intoevents. Note that the data can include lines of text that are separatedby carriage returns or line breaks and an event may include one or moreof these lines. During the apportioning process, the indexer can useheuristic rules to automatically determine the boundaries of the events,which for example coincide with line boundaries. These heuristic rulesmay be determined based on the source of the data, wherein the indexercan be explicitly informed about the source of the data or can infer thesource of the data by examining the data. These heuristic rules caninclude regular expression-based rules or delimiter-based rules fordetermining event boundaries, wherein the event boundaries may beindicated by predefined characters or character strings. Thesepredefined characters may include punctuation marks or other specialcharacters including, for example, carriage returns, tabs, spaces orline breaks. In some cases, a user can fine-tune or configure the rulesthat the indexers use to determine event boundaries in order to adaptthe rules to the user's specific requirements.

Next, the indexer determines a timestamp for each event at block 203. Asmentioned above, these timestamps can be determined by extracting thetime directly from data in the event, or by interpolating the time basedon timestamps from temporally proximate events. In some cases, atimestamp can be determined based on the time the data was received orgenerated. The indexer subsequently associates the determined timestampwith each event at block 204, for example by storing the timestamp asmetadata for each event.

Then, the system can apply transformations to data to be included inevents at block 205. For log data, such transformations can includeremoving a portion of an event (e.g., a portion used to define eventboundaries, extraneous text, characters, etc.) or removing redundantportions of an event. Note that a user can specify portions to beremoved using a regular expression or any other possible technique.

Next, a keyword index can optionally be generated to facilitate fastkeyword searching for events. To build a keyword index, the indexerfirst identifies a set of keywords in block 206. Then, at block 207 theindexer includes the identified keywords in an index, which associateseach stored keyword with references to events containing that keyword(or to locations within events where that keyword is located). When anindexer subsequently receives a keyword-based query, the indexer canaccess the keyword index to quickly identify events containing thekeyword.

In some embodiments, the keyword index may include entries forname-value pairs found in events, wherein a name-value pair can includea pair of keywords connected by a symbol, such as an equals sign orcolon. In this way, events containing these name-value pairs can bequickly located. In some embodiments, fields can automatically begenerated for some or all of the name-value pairs at the time ofindexing. For example, if the string “dest=10.0.1.2” is found in anevent, a field named “dest” may be created for the event, and assigned avalue of “10.0.1.2.”

Finally, the indexer stores the events in a data store at block 208,wherein a timestamp can be stored with each event to facilitatesearching for events based on a time range. In some cases, the storedevents are organized into a plurality of buckets, wherein each bucketstores events associated with a specific time range. This not onlyimproves time-based searches, but it also allows events with recenttimestamps that may have a higher likelihood of being accessed to bestored in faster memory to facilitate faster retrieval. For example, abucket containing the most recent events can be stored in flash memoryinstead of on hard disk.

Each indexer 102 is responsible for storing and searching a subset ofthe events contained in a corresponding data store 103. By distributingevents among the indexers and data stores, the indexers can analyzeevents for a query in parallel, for example using map-reduce techniques,wherein each indexer returns partial responses for a subset of events toa search head that combines the results to produce an answer for thequery. By storing events in buckets for specific time ranges, an indexermay further optimize searching by looking only in buckets for timeranges that are relevant to a query.

Moreover, events and buckets can also be replicated across differentindexers and data stores to facilitate high availability and disasterrecovery as is described in U.S. patent application Ser. No. 14/266,812filed on 30 Apr. 2014, and in U.S. patent application Ser. No.14/266,817 also filed on 30 Apr. 2014.

1.4 Query Processing

FIG. 3 presents a flowchart illustrating how a search head and indexersperform a search query in accordance with the disclosed embodiments. Atthe start of this process, a search head receives a search query from aclient at block 301. Next, at block 302, the search head analyzes thesearch query to determine what portions can be delegated to indexers andwhat portions need to be executed locally by the search head. At block303, the search head distributes the determined portions of the query tothe indexers. Note that commands that operate on single events can betrivially delegated to the indexers, while commands that involve eventsfrom multiple indexers are harder to delegate.

Then, at block 304, the indexers to which the query was distributedsearch their data stores for events that are responsive to the query. Todetermine which events are responsive to the query, the indexer searchesfor events that match the criteria specified in the query. This criteriacan include matching keywords or specific values for certain fields. Ina query that uses a late-binding schema, the searching operations inblock 304 may involve using the late-binding scheme to extract valuesfor specified fields from events at the time the query is processed.Next, the indexers can either send the relevant events back to thesearch head, or use the events to calculate a partial result, and sendthe partial result back to the search head.

Finally, at block 305, the search head combines the partial resultsand/or events received from the indexers to produce a final result forthe query. This final result can comprise different types of datadepending upon what the query is asking for. For example, the finalresults can include a listing of matching events returned by the query,or some type of visualization of data from the returned events. Inanother example, the final result can include one or more calculatedvalues derived from the matching events.

Moreover, the results generated by system 100 can be returned to aclient using different techniques. For example, one technique streamsresults back to a client in real-time as they are identified. Anothertechnique waits to report results to the client until a complete set ofresults is ready to return to the client. Yet another technique streamsinterim results back to the client in real-time until a complete set ofresults is ready, and then returns the complete set of results to theclient. In another technique, certain results are stored as “searchjobs,” and the client may subsequently retrieve the results byreferencing the search jobs.

The search head can also perform various operations to make the searchmore efficient. For example, before the search head starts executing aquery, the search head can determine a time range for the query and aset of common keywords that all matching events must include. Next, thesearch head can use these parameters to query the indexers to obtain asuperset of the eventual results. Then, during a filtering stage, thesearch head can perform field-extraction operations on the superset toproduce a reduced set of search results.

1.5 Field Extraction

FIG. 4 presents a block diagram illustrating how fields can be extractedduring query processing in accordance with the disclosed embodiments. Atthe start of this process, a search query 402 is received at a queryprocessor 404. Query processor 404 includes various mechanisms forprocessing a query, wherein these mechanisms can reside in a search head104 and/or an indexer 102. Note that the exemplary search query 402illustrated in FIG. 4 is expressed in Search Processing Language (SPL),which is used in conjunction with the SPLUNK® ENTERPRISE system. SPL isa pipelined search language in which a set of inputs is operated on by afirst command in a command line, and then a subsequent command followingthe pipe symbol “I” operates on the results produced by the firstcommand, and so on for additional commands. Search query 402 can also beexpressed in other query languages, such as the Structured QueryLanguage (“SQL”) or any suitable query language.

Upon receiving search query 402, query processor 404 sees that searchquery 402 includes two fields “IP” and “target.” Query processor 404also determines that the values for the “IP” and “target” fields havenot already been extracted from events in data store 414, andconsequently determines that query processor 404 needs to use extractionrules to extract values for the fields. Hence, query processor 404performs a lookup for the extraction rules in a rule base 406, whereinrule base 406 maps field names to corresponding extraction rules andobtains extraction rules 408-409, wherein extraction rule 408 specifieshow to extract a value for the “IP” field from an event, and extractionrule 409 specifies how to extract a value for the “target” field from anevent. As is illustrated in FIG. 4, extraction rules 408-409 cancomprise regular expressions that specify how to extract values for therelevant fields. Such regular-expression-based extraction rules are alsoreferred to as “regex rules.” In addition to specifying how to extractfield values, the extraction rules may also include instructions forderiving a field value by performing a function on a character string orvalue retrieved by the extraction rule. For example, a transformationrule may truncate a character string, or convert the character stringinto a different data format. In some cases, the query itself canspecify one or more extraction rules.

Next, query processor 404 sends extraction rules 408-409 to a fieldextractor 412, which applies extraction rules 408-409 to events 416-418in a data store 414. Note that data store 414 can include one or moredata stores, and extraction rules 408-409 can be applied to largenumbers of events in data store 414, and are not meant to be limited tothe three events 416-418 illustrated in FIG. 4. Moreover, the queryprocessor 404 can instruct field extractor 412 to apply the extractionrules to all the events in a data store 414, or to a subset of theevents that have been filtered based on some criteria.

Next, field extractor 412 applies extraction rule 408 for the firstcommand “Search IP=“10*” to events in data store 414 including events416-418. Extraction rule 408 is used to extract values for the IPaddress field from events in data store 414 by looking for a pattern ofone or more digits, followed by a period, followed again by one or moredigits, followed by another period, followed again by one or moredigits, followed by another period, and followed again by one or moredigits. Next, field extractor 412 returns field values 420 to queryprocessor 404, which uses the criterion IP=“10*” to look for IPaddresses that start with “10”. Note that events 416 and 417 match thiscriterion, but event 418 does not, so the result set for the firstcommand is events 416-417.

Query processor 404 then sends events 416-417 to the next command “statscount target.” To process this command, query processor 404 causes fieldextractor 412 to apply extraction rule 409 to events 416-417. Extractionrule 409 is used to extract values for the target field for events416-417 by skipping the first four commas in events 416-417, and thenextracting all of the following characters until a comma or period isreached. Next, field extractor 412 returns field values 421 to queryprocessor 404, which executes the command “stats count target” to countthe number of unique values contained in the target fields, which inthis example produces the value “2” that is returned as a final result422 for the query.

Note that query results can be returned to a client, a search head, orany other system component for further processing. In general, queryresults may include: a set of one or more events; a set of one or morevalues obtained from the events; a subset of the values; statisticscalculated based on the values; a report containing the values; or avisualization, such as a graph or chart, generated from the values.

1.6 Exemplary Search Screen

FIG. 6A illustrates an exemplary search screen 600 in accordance withthe disclosed embodiments. Search screen 600 includes a search bar 602that accepts user input in the form of a search string. It also includesa time range picker 612 that enables the user to specify a time rangefor the search. For “historical searches” the user can select a specifictime range, or alternatively a relative time range, such as “today,”“yesterday” or “last week.” For “real-time searches,” the user canselect the size of a preceding time window to search for real-timeevents. Search screen 600 also initially displays a “data summary”dialog as is illustrated in FIG. 6B that enables the user to selectdifferent sources for the event data, for example by selecting specifichosts and log files.

After the search is executed, the search screen 600 can display theresults through search results tabs 604, wherein search results tabs 604include: an “events tab” that displays various information about eventsreturned by the search; a “statistics tab” that displays statisticsabout the search results; and a “visualization tab” that displaysvarious visualizations of the search results. The events tab illustratedin FIG. 6A displays a timeline graph 605 that graphically illustratesthe number of events that occurred in one-hour intervals over theselected time range. It also displays an events list 608 that enables auser to view the raw data in each of the returned events. Itadditionally displays a fields sidebar 606 that includes statisticsabout occurrences of specific fields in the returned events, including“selected fields” that are pre-selected by the user, and “interestingfields” that are automatically selected by the system based onpre-specified criteria.

1.7 Acceleration Techniques

The above-described system provides significant flexibility by enablinga user to analyze massive quantities of minimally processed performancedata “on the fly” at search time instead of storing pre-specifiedportions of the performance data in a database at ingestion time. Thisflexibility enables a user to see correlations in the performance dataand perform subsequent queries to examine interesting aspects of theperformance data that may not have been apparent at ingestion time.

However, performing extraction and analysis operations at search timecan involve a large amount of data and require a large number ofcomputational operations, which can cause considerable delays whileprocessing the queries. Fortunately, a number of acceleration techniqueshave been developed to speed up analysis operations performed at searchtime. These techniques include: (1) performing search operations inparallel by formulating a search as a map-reduce computation; (2) usinga keyword index; (3) using a high performance analytics store; and (4)accelerating the process of generating reports. These techniques aredescribed in more detail below.

1.7.1 Map-Reduce Technique

To facilitate faster query processing, a query can be structured as amap-reduce computation, wherein the “map” operations are delegated tothe indexers, while the corresponding “reduce” operations are performedlocally at the search head. For example, FIG. 5 illustrates how a searchquery 501 received from a client at search head 104 can be split intotwo phases, including: (1) a “map phase” comprising subtasks 502 (e.g.,data retrieval or simple filtering) that may be performed in paralleland are “mapped” to indexers 102 for execution, and (2) a “reduce phase”comprising a merging operation 503 to be executed by the search headwhen the results are ultimately collected from the indexers.

During operation, upon receiving search query 501, search head 104modifies search query 501 by substituting “stats” with “prestats” toproduce search query 502, and then distributes search query 502 to oneor more distributed indexers, which are also referred to as “searchpeers.” Note that search queries may generally specify search criteriaor operations to be performed on events that meet the search criteria.Search queries may also specify field names, as well as search criteriafor the values in the fields or operations to be performed on the valuesin the fields. Moreover, the search head may distribute the full searchquery to the search peers as is illustrated in FIG. 3, or mayalternatively distribute a modified version (e.g., a more restrictedversion) of the search query to the search peers. In this example, theindexers are responsible for producing the results and sending them tothe search head. After the indexers return the results to the searchhead, the search head performs the merging operations 503 on theresults. Note that by executing the computation in this way, the systemeffectively distributes the computational operations while minimizingdata transfers.

1.7.2 Keyword Index

As described above with reference to the flow charts in FIGS. 2 and 3,event-processing system 100 can construct and maintain one or morekeyword indices to facilitate rapidly identifying events containingspecific keywords. This can greatly speed up the processing of queriesinvolving specific keywords. As mentioned above, to build a keywordindex, an indexer first identifies a set of keywords. Then, the indexerincludes the identified keywords in an index, which associates eachstored keyword with references to events containing that keyword, or tolocations within events where that keyword is located. When an indexersubsequently receives a keyword-based query, the indexer can access thekeyword index to quickly identify events containing the keyword.

1.7.3 High Performance Analytics Store

To speed up certain types of queries, some embodiments of system 100make use of a high performance analytics store, which is referred to asa “summarization table,” that contains entries for specific field-valuepairs. Each of these entries keeps track of instances of a specificvalue in a specific field in the event data and includes references toevents containing the specific value in the specific field. For example,an exemplary entry in a summarization table can keep track ofoccurrences of the value “94107” in a “ZIP code” field of a set ofevents, wherein the entry includes references to all of the events thatcontain the value “94107” in the ZIP code field. This enables the systemto quickly process queries that seek to determine how many events have aparticular value for a particular field, because the system can examinethe entry in the summarization table to count instances of the specificvalue in the field without having to go through the individual events ordo extractions at search time. Also, if the system needs to process allevents that have a specific field-value combination, the system can usethe references in the summarization table entry to directly access theevents to extract further information without having to search all ofthe events to find the specific field-value combination at search time.

In some embodiments, the system maintains a separate summarization tablefor each of the above-described time-specific buckets that stores eventsfor a specific time range, wherein a bucket-specific summarization tableincludes entries for specific field-value combinations that occur inevents in the specific bucket. Alternatively, the system can maintain aseparate summarization table for each indexer, wherein theindexer-specific summarization table only includes entries for theevents in a data store that is managed by the specific indexer.

The summarization table can be populated by running a “collection query”that scans a set of events to find instances of a specific field-valuecombination, or alternatively instances of all field-value combinationsfor a specific field. A collection query can be initiated by a user, orcan be scheduled to occur automatically at specific time intervals. Acollection query can also be automatically launched in response to aquery that asks for a specific field-value combination.

In some cases, the summarization tables may not cover all of the eventsthat are relevant to a query. In this case, the system can use thesummarization tables to obtain partial results for the events that arecovered by summarization tables, but may also have to search throughother events that are not covered by the summarization tables to produceadditional results. These additional results can then be combined withthe partial results to produce a final set of results for the query.This summarization table and associated techniques are described in moredetail in U.S. Pat. No. 8,682,925, issued on Mar. 25, 2014.

1.7.4 Accelerating Report Generation

In some embodiments, a data server system such as the SPLUNK® ENTERPRISEsystem can accelerate the process of periodically generating updatedreports based on query results. To accelerate this process, asummarization engine automatically examines the query to determinewhether generation of updated reports can be accelerated by creatingintermediate summaries. (This is possible if results from preceding timeperiods can be computed separately and combined to generate an updatedreport. In some cases, it is not possible to combine such incrementalresults, for example where a value in the report depends onrelationships between events from different time periods.) If reportscan be accelerated, the summarization engine periodically generates asummary covering data obtained during a latest non-overlapping timeperiod. For example, where the query seeks events meeting a specifiedcriteria, a summary for the time period includes only events within thetime period that meet the specified criteria. Similarly, if the queryseeks statistics calculated from the events, such as the number ofevents that match the specified criteria, then the summary for the timeperiod includes the number of events in the period that match thespecified criteria.

In parallel with the creation of the summaries, the summarization engineschedules the periodic updating of the report associated with the query.During each scheduled report update, the query engine determines whetherintermediate summaries have been generated covering portions of the timeperiod covered by the report update. If so, then the report is generatedbased on the information contained in the summaries. Also, if additionalevent data has been received and has not yet been summarized, and isrequired to generate the complete report, the query can be run on thisadditional event data. Then, the results returned by this query on theadditional event data, along with the partial results obtained from theintermediate summaries, can be combined to generate the updated report.This process is repeated each time the report is updated. Alternatively,if the system stores events in buckets covering specific time ranges,then the summaries can be generated on a bucket-by-bucket basis. Notethat producing intermediate summaries can save the work involved inre-running the query for previous time periods, so only the newer eventdata needs to be processed while generating an updated report. Thesereport acceleration techniques are described in more detail in U.S. Pat.No. 8,589,403, issued on Nov. 19, 2013, and U.S. Pat. No. 8,412,696,issued on Apr. 2, 2011.

1.8 Security Features

The SPLUNK® ENTERPRISE platform provides various schemas, dashboards andvisualizations that make it easy for developers to create applicationsto provide additional capabilities. One such application is the SPLUNK®APP FOR ENTERPRISE SECURITY, which performs monitoring and alertingoperations and includes analytics to facilitate identifying both knownand unknown security threats based on large volumes of data stored bythe SPLUNK® ENTERPRISE system. This differs significantly fromconventional Security Information and Event Management (SIEM) systemsthat lack the infrastructure to effectively store and analyze largevolumes of security-related event data. Traditional SIEM systemstypically use fixed schemas to extract data from pre-definedsecurity-related fields at data ingestion time, wherein the extracteddata is typically stored in a relational database. This data extractionprocess (and associated reduction in data size) that occurs at dataingestion time inevitably hampers future incident investigations, whenall of the original data may be needed to determine the root cause of asecurity issue, or to detect the tiny fingerprints of an impendingsecurity threat.

In contrast, the SPLUNK® APP FOR ENTERPRISE SECURITY system stores largevolumes of minimally processed security-related data at ingestion timefor later retrieval and analysis at search time when a live securitythreat is being investigated. To facilitate this data retrieval process,the SPLUNK® APP FOR ENTERPRISE SECURITY provides pre-specified schemasfor extracting relevant values from the different types ofsecurity-related event data, and also enables a user to define suchschemas.

The SPLUNK® APP FOR ENTERPRISE SECURITY can process many types ofsecurity-related information. In general, this security-relatedinformation can include any information that can be used to identifysecurity threats. For example, the security-related information caninclude network-related information, such as IP addresses, domain names,asset identifiers, network traffic volume, uniform resource locatorstrings, and source addresses. (The process of detecting securitythreats for network-related information is further described in U.S.patent application Ser. No. 13/956,252, and Ser. No. 13/956,262.)Security-related information can also include endpoint information, suchas malware infection data and system configuration information, as wellas access control information, such as login/logout information andaccess failure notifications. The security-related information canoriginate from various sources within a data center, such as hosts,virtual machines, storage devices, and sensors. The security-relatedinformation can also originate from various sources in a network, suchas routers, switches, email servers, proxy servers, gateways, firewalls,and intrusion-detection systems.

During operation, the SPLUNK® APP FOR ENTERPRISE SECURITY facilitatesdetecting so-called “notable events” that are likely to indicate asecurity threat. These notable events can be detected in a number ofways: (1) an analyst can notice a correlation in the data and canmanually identify a corresponding group of one or more events as“notable;” or (2) an analyst can define a “correlation search”specifying criteria for a notable event, and every time one or moreevents satisfy the criteria, the application can indicate that the oneor more events are notable. An analyst can alternatively select apre-defined correlation search provided by the application. Note thatcorrelation searches can be run continuously or at regular intervals(e.g., every hour) to search for notable events. Upon detection, notableevents can be stored in a dedicated “notable events index,” which can besubsequently accessed to generate various visualizations containingsecurity-related information. Also, alerts can be generated to notifysystem operators when important notable events are discovered.

The SPLUNK® APP FOR ENTERPRISE SECURITY provides various visualizationsto aid in discovering security threats, such as a “key indicators view”that enables a user to view security metrics of interest, such as countsof different types of notable events. For example, FIG. 7A illustratesan exemplary key indicators view 700 that comprises a dashboard, whichcan display a value 701, for various security-related metrics, such asmalware infections 702. It can also display a change in a metric value703, which indicates that the number of malware infections increased by63 during the preceding interval. Key indicators view 700 additionallydisplays a histogram panel 704 that displays a histogram of notableevents organized by urgency values, and a histogram of notable eventsorganized by time intervals. This key indicators view is described infurther detail in pending U.S. patent application Ser. No. 13/956,338filed Jul. 31, 2013.

These visualizations can also include an “incident review dashboard”that enables a user to view and act on “notable events.” These notableevents can include: (1) a single event of high importance, such as anyactivity from a known web attacker; or (2) multiple events thatcollectively warrant review, such as a large number of authenticationfailures on a host followed by a successful authentication. For example,FIG. 7B illustrates an exemplary incident review dashboard 710 thatincludes a set of incident attribute fields 711 that, for example,enables a user to specify a time range field 712 for the displayedevents. It also includes a timeline 713 that graphically illustrates thenumber of incidents that occurred in one-hour time intervals over theselected time range. It additionally displays an events list 714 thatenables a user to view a list of all of the notable events that matchthe criteria in the incident attributes fields 711. To facilitateidentifying patterns among the notable events, each notable event can beassociated with an urgency value (e.g., low, medium, high, critical),which is indicated in the incident review dashboard. The urgency valuefor a detected event can be determined based on the severity of theevent and the priority of the system component associated with theevent. The incident review dashboard is described further in“http://docs.splunk.com/Documentation/PCI/2.1.1/User/IncidentReviewdashboard.”

1.9 Data Center Monitoring

As mentioned above, the SPLUNK® ENTERPRISE platform provides variousfeatures that make it easy for developers to create variousapplications. One such application is the SPLUNK® APP FOR VMWARE®, whichperforms monitoring operations and includes analytics to facilitatediagnosing the root cause of performance problems in a data center basedon large volumes of data stored by the SPLUNK® ENTERPRISE system.

This differs from conventional data-center-monitoring systems that lackthe infrastructure to effectively store and analyze large volumes ofperformance information and log data obtained from the data center. Inconventional data-center-monitoring systems, this performance data istypically pre-processed prior to being stored, for example by extractingpre-specified data items from the performance data and storing them in adatabase to facilitate subsequent retrieval and analysis at search time.However, the rest of the performance data is not saved and isessentially discarded during pre-processing. In contrast, the SPLUNK®APP FOR VMWARE® stores large volumes of minimally processed performanceinformation and log data at ingestion time for later retrieval andanalysis at search time when a live performance issue is beinginvestigated.

The SPLUNK® APP FOR VMWARE® can process many types ofperformance-related information. In general, this performance-relatedinformation can include any type of performance-related data and logdata produced by virtual machines and host computer systems in a datacenter. In addition to data obtained from various log files, thisperformance-related information can include values for performancemetrics obtained through an application programming interface (API)provided as part of the vSphere Hypervisor™ system distributed byVMware, Inc. of Palo Alto, Calif. For example, these performance metricscan include: (1) CPU-related performance metrics; (2) disk-relatedperformance metrics; (3) memory-related performance metrics; (4)network-related performance metrics; (5) energy-usage statistics; (6)data-traffic-related performance metrics; (7) overall systemavailability performance metrics; (8) cluster-related performancemetrics; and (9) virtual machine performance statistics. For moredetails about such performance metrics, please see U.S. patentapplication Ser. No. 14/167,316 filed 29 Jan. 2014, which is herebyincorporated herein by reference. Also, see “vSphere Monitoring andPerformance,” Update 1, vSphere 5.5, EN-001357-00,http://pubs.vmware.com/vsphere-55/topic/com.vmware.ICbase/PDF/vsphere-esxi-vcenter-server-551-monitoring-performance-guide.pdf.

To facilitate retrieving information of interest from performance dataand log files, the SPLUNK® APP FOR VMWARE® provides pre-specifiedschemas for extracting relevant values from different types ofperformance-related event data, and also enables a user to define suchschemas.

The SPLUNK® APP FOR VMWARE® additionally provides various visualizationsto facilitate detecting and diagnosing the root cause of performanceproblems. For example, one such visualization is a “proactive monitoringtree” that enables a user to easily view and understand relationshipsamong various factors that affect the performance of a hierarchicallystructured computing system. This proactive monitoring tree enables auser to easily navigate the hierarchy by selectively expanding nodesrepresenting various entities (e.g., virtual centers or computingclusters) to view performance information for lower-level nodesassociated with lower-level entities (e.g., virtual machines or hostsystems). Exemplary node-expansion operations are illustrated in FIG.7C, wherein nodes 733 and 734 are selectively expanded. Note that nodes731-739 can be displayed using different patterns or colors to representdifferent performance states, such as a critical state, a warning state,a normal state, or an unknown/offline state. The ease of navigationprovided by selective expansion in combination with the associatedperformance-state information enables a user to quickly diagnose theroot cause of a performance problem. The proactive monitoring tree isdescribed in further detail in U.S. patent application Ser. No.14/235,490 filed on 15 Apr. 2014, which is hereby incorporated herein byreference for all possible purposes.

The SPLUNK® APP FOR VMWARE® also provides a user interface that enablesa user to select a specific time range and then view heterogeneous data,comprising events, log data, and associated performance metrics, for theselected time range. For example, the screen illustrated in FIG. 7Ddisplays a listing of recent “tasks and events” and a listing of recent“log entries” for a selected time range above a performance-metric graphfor “average CPU core utilization” for the selected time range. Notethat a user is able to operate pull-down menus 742 to selectivelydisplay different performance metric graphs for the selected time range.This enables the user to correlate trends in the performance-metricgraph with corresponding event and log data to quickly determine theroot cause of a performance problem. This user interface is described inmore detail in U.S. patent application Ser. No. 14/167,316 filed on 29Jan. 2014, which is hereby incorporated herein by reference for allpossible purposes.

2.0 Additional Exemplary Search Screen

FIG. 8A illustrates exemplary search screen 800 in accordance with someimplementations of the present disclosure. Search screen 800 may beutilized as part of a search interface to display one or more eventsreturned as part of a search result set based on a search query. Displayof an event may include display of one or more event attributes of theevent, examples of which include extracted fields, metadata, event rawdata, and/or other types of data items assigned to the event. Searchscreen 800 may also be utilized as part of a search interface thatallows a user to modify the search query. Some exemplary options formodifying the search query include any combination of deleting commandsfrom the search query, adding commands to the search query, reorderingone or more commands in the search query, and modifying variables,parameters, arguments, and/or other properties of commands in the searchquery.

Search screen 800 may also be utilized to update the search result setto correspond to the modified search query and to update the events thatare displayed in search screen 800 to correspond to the updated searchresult set. In some cases, based on a search query being modified, thesearch query could be completely re-executed to retrieve new searchresults and generate the updated search result set. In other cases, thesearch query may only be partially executed. For example, inimplementations where a pipelined search language, such as SPL, isemployed for search queries, additional commands that are added to asearch query may be applied to at least some previous search results.These and other variations are possible for updating the search resultset to correspond to a search query.

By interacting with search screen 800 to create and/or modify searchqueries, a user may utilize the search interface to filter, sort, clean,enrich, analyze, report on, and/or otherwise carryout functionalityprovided for by commands in search queries. Furthermore, as the usergenerates modified search queries, the search result set can be updated,with events displayed in search screen 800 being updated to reflect themodifications. Utilizing this approach, a user may iteratively modify asearch query and view the impact of the modification via updated searchresults. This approach can be employed to enable users to effectivelyand efficiently generate queries that return expected and desiredresults, even without extensive knowledge of the underlying commandsand/or search language employed by the queries.

2.1 Exemplary Table Format

In various implementations, one or more events can be displayed in atable format, such as table format 802 in search screen 800. The tableformat can be employed in various interfaces for interacting withdisplayed events in various ways and its use is not limited to searchinterfaces or search screens. Events can be used to populate the tableformat, and may be search results, such as in search screen 800, butcould more generally be any type of events. Furthermore while in searchscreen 800, events are displayed via table format 802, other formats arepossible in various implementations contemplated herein.

Table format 802 comprises one or more columns, such as columns 804 a,804 b, 804 c, and 804 d and one or more rows, such as rows 806 a, 806 b,806 c, 806 d, and 806 e. Table format 802 can include additional rowsand/or columns, not shown in FIG. 8A, which may optionally be viewed byscrolling search screen 800, or by other suitable means. The scrollingmay reveal additional events and/or additional event attributes onsearch screen 800.

In the example shown, each row corresponds to an event. By way ofexample, search screen 800 is shown as displaying events 1, 2, 3, 4, and5, which are each search results of a search result set that can includeany number of additional results that are not shown. A search resultsset may generally include any number of search results. Each columncorresponds to an event attribute, such as an extracted field, metadataabout events (e.g., a default field), or event raw data Each eventattribute is assigned a respective attribute label, which can beutilized to represent the corresponding attribute in the table format.For example, row 806 a corresponds to event 1 and column 804 acorresponds to an event attribute of event 1 having an attribute labelof _time, comprising a timestamp data item. Other attribute labels shownin FIG. 8A include _raw, corresponding to event raw data, source andhost corresponding to metadata, and bytes, clientip, method, andreferer, corresponding to extracted fields.

The rows in table format 802 form cells with the columns, and each cellcomprises a data item of an event attribute of a corresponding column.For example, in search screen 800, the event attribute having attributelabel _time has a value of 2013-11-10T18:22:16.000-0800 for event 1,2013-11-10T18:22:15.000-0800 for event 2, and so on. Data items ofevents are shown in FIG. 8A by a textual representation of their value.Although not the case in the table formats shown herein, it is possiblethat the underlying value could vary from the textual representation. Asan example, numeric data items could be textually represented in roundedform. Furthermore, some of the data items could be represented by meansother than a textual representation.

Data items in a column are assigned to an event attribute forming setsof attribute-data item pairs, with each data item corresponding to arespective event for that event attribute. Search screen 800 shows dataitems of multiple events for each event attribute. The displayed eventattributes correspond to the search result set, but other eventattributes corresponding to the search result set could potentially behidden from view or not included in a column.

In the present example, each row in table format 802 corresponds to arespective event and each column corresponds to a respective eventattribute of multiple events, with each cell comprising one or more dataitems of the respective event attribute of the respective event. In somecases, columns of the table format may be reordered in a displayedsearch interface based on a user interaction with the table format. Forexample, a user may select a column to move (e.g., using a mouse) anddrag the selected column to a new position in the table format.

A search query corresponding to the search result set that is utilizedto populate the cells of table format 802 can have its constituentcommands be at least partially represented in search screen 800. Onesuch approach is illustrated by command entry list 808 in search screen800. Exemplary command entry lists will later be described in additionaldetail, and for purposes of the present disclosure, can be employed withother types of interfaces, which do not necessarily include eventsdisplayed in a table format.

Command entry list 808 corresponds to at least a partial representationof the commands of the search query and comprises one or more commandentries. Each command entry is respectively representing one or morecommands of the search query. Furthermore, the list of search commandentries is displayed in a sequence corresponding to a sequence of thesearch commands within the search query. Another approach to at leastpartially representing search commands of the search query in searchscreen 800 comprises utilizing a search bar, in addition to, or insteadof a command entry list. The search bar can accept user input in theform of textual input to a search string that corresponds to the searchquery.

2.2 Exemplary Interactions with a Table Format

In some implementations, a user can interact with one or more events ofa set of events (e.g., a search result set) that are used to populate atable format by interacting with the table format. For example, a usercan interact with table format 802, which is populated with at leastsome data items from events that correspond to the search result set.

In some respects, a user can make a selection of one or more portions ofthe table format. Based on the selection, the system causes for displayone or more options (e.g., a list of options) corresponding to theselected one or more portions. Based on a user selecting one of thedisplayed options, operations corresponding to the displayed option canbe carried out by the system.

In implementations where the table format is part of a search system,the interactions can be made to create and/or modify search queries. Insome approaches, a user makes a selection of one or more portions of thetable format. Based on the selection, the search system causes fordisplay one or more options (e.g., a list of options) corresponding tothe selection. The search system can cause one or more commands to beadded to a search query that corresponds to the set of events used topopulate the table format, based on a user selecting one of the optionsfrom the list of options. The one or more commands that are added to thesearch query can be based on (e.g., generated based on) at least theoption that is selected by the user, and potentially other factors, suchas one or more data items and/or one or more event attributes in theselected one or more portions of the table format.

Examples of selectable portions of a table format include selectablerows, columns, cells, and text, which are described in additional detailbelow. Depending on the implementation employed, any combination ofthese table elements may or may not be selectable. As an example, insome implementations, one or more cells may be selectable withoutnecessarily requiring other portions of the table format to beselectable (i.e., only cells could be selectable). The same is true forother types of table elements, such as columns, and text. Furthermore,in some cases portions of the table format are individually selectable(e.g., individual cells or individual columns could be selected). Inaddition, or instead, portions may be selectable in groups (e.g.,multiple cells or multiple columns could be selected).

FIGS. 8B, 8C, 8D, 8E, and 8F represent search screen 800 afterrespective portions of table format 802 have been selected by a user.FIG. 8B illustrates where a selected portion is an individual cell(e.g., cell 810), although in some implementations a user may selectmultiple cells. FIG. 8C illustrates where a selected portion is anindividual column (e.g., column 804 a). FIG. 8D illustrates wheremultiple columns are selected (e.g., columns 804 b and 804 c). FIG. 8Eillustrates where table format 802 itself is selected. FIG. 8Fillustrates where a portion of a textual representation (text) of one ormore data items (e.g., portion 814 (a text portion) of textualrepresentation 812) is selected. It is noted that, where multiplecolumns are selected by a user, the selected columns need not beadjacent to one another, as shown. Similarly, where multiple cells areselected in the table format, those selected cells need not be adjacentto one another.

Although many approaches exist for selection of portions of a tableformat, in some implementations, a selectable portion(s) may behighlighted or otherwise emphasized when a pointer that is displayed inthe user interface moves over a particular region of the display (e.g.,a region of the table format) that corresponds to the selectableportion(s). This feature is also referred to as highlight with rollover(e.g., detected when a pointer moves over a region). One or morehighlighted selectable portions can then be selected in response toadditional user input, such as a mouse click or touch input to selectthe selectable portions. A shift-click or other method could be utilizedto select additional selectable portions.

By way of example, in search screen 800, each cell is individuallyselectable and the region for each cell is substantially coextensivewith the cell. For example, in FIG. 8B, region 820 a can be used toselect cell 810, which is shown as being emphasized and selected.Furthermore, each column is individually selectable and the region foreach column is coextensive with the column's header, which comprises anattribute label of the event attribute of the column. For example, inFIG. 8C, region 820 b can be used to select column 804 a, which is shownas being emphasized and selected. In implementations where rows areselectable, the region for a row could similarly correspond to the row'sheader (displaying the event number in the present implementation).

Selection of a textual representation, or a portion thereof, couldoptionally be handled, at least partially using highlight with rollover.In search screen 800, a portion of a textual representation may beselected by the user using a click, drag to highlight, and release, asone example. Any of the various characters in text of a textualrepresentation may be highlighted and selected, and in someimplementations, multiple textual representation portions could beselected from multiple cells.

2.3 Exemplary Options

A variety of approaches are available for presenting options that aredisplayed based on and corresponding to the selection of one or moreportions of the table format. In some implementations, options can bepresented as a list of selectable options. Options may appear in sidebar830, or elsewhere. In FIGS. 8B, 8C, 8D, 8E, and 8F, options aredisplayed in option menus. Display locations of option menus can bebased on the one or more portions of the table format that are selectedby the user. For example, option menus can be configured to appearproximate to (e.g., over, or adjacent to) the one or more selectedportions of the table format, as illustrated by option menus 826 a, 826b, 826 c, 826 d, and 826 e.

FIG. 9 shows exemplary option menu 926 in accordance withimplementations of the present disclosure. Option menu 926 comprisesoptions 930 a, 930 b, 930 c, and 930 d, and is utilized to describeexemplary configurations for option menus, such as any of option menus826 a, 826 b, 826 c, 826 d, and 826 e. In the present implementation,each option can correspond to one or more commands that may be includedin a search query. However, in some cases, options need not correspondto one or more commands that may be included in a search query. Instead,the option may be operable to interact with the system in some othermanner. Where, an option corresponds to a command, the command may beprovided to a search query utilizing a format that includes a commandidentifier that identifies the command and one or more command elementsof the command, at least some of which may be optional (e.g., arguments,parameters, values, command options, and the like). In particular, eachcommand could correspond to a pipelined search language command, such asan SPL command, or another type of command compatible with processing ofthe search query.

In various implementations, option menu 926 is a contextual menu. Inthis regard, one or more of the options in option menu 926 can beincluded based on context related to the selection that prompted optionmenu 926. For example, option 930 a may be included in option menu 926in some contexts, but not in others. This may be desirable in that itmay be more intuitive for some options to be invoked in some selectioncontexts, but not in others. Furthermore, one or more options in optionmenu 926 may be a contextual option. In this regard, one or more commendelements for any commands corresponding to an option may be incorporatedinto the commands based on selection context. Furthermore, at least someof the label of the option in option menu 926 can be based on selectioncontext.

In some respects, context can be based, at least partially on the typeor types of table elements of the table format selected by the user. Invarious implementations, the presented option menu may include differentoptions depending on whether the selected portion of the table format isa column, a cell, a portion of a textual representation of a data item,or the table itself. For example, option 930 c may be included in optionmenu 826 b for a selection of column 804 a, but not in option menu 826 afor a selection of cell 810. This may be desirable in that it may bemore intuitive for some options to be invoked through selecting a columnas opposed to a cell, or vice versa. As an example, the option maycorrespond to a command that operates on cells of a column, or thecolumn itself, and therefore might be more intuitive when included as anoption for a selected column. As such, the option might be contextuallyincluded based on selection of a column, but not based on selection of acell.

Context can further be based on a number of selected portions of thetable format, or a number of selected portions of the table format ofone or more particular types of table elements. For example, option 930d may be included in option menu 826 c of FIG. 8D for a selection ofmultiple columns 804 b and 804 c, but not in option menu 826 b of FIG.8C for a selection of only column 804 a. In this way options included inoption menu 826 c may be different than the options included in optionmenu 826 b based on the selected portion comprising two columns in ofFIG. 8D, but only one column in FIG. 8C (e.g., based on the number beinggreater than one column, or based on the number being equal to adesignated number of columns). As another possibility, where selectionportions of a table format comprise a first selected cell and a secondselected cell, an option may be caused to be included in option menu 926based on a determination that the first and second cells are indifferent columns in the table format.

Context can also be based on the event attribute(s) corresponding to theselected portion(s) of the table format. For example, one or moreoptions may be included in option menu 926 based on the user selecting acolumn, cell, or textual representation corresponding to event raw data(e.g., _raw), or based on the user selecting a table portioncorresponding to event timestamps (e.g., _time).

Thus, for example, an option may be included in option menu 926 based ona determination that at least one of one or more data items of at leastone selected one or more cells comprises event raw data, and/or that atleast one of selected one or more columns represent event raw data of aset of events. Furthermore, an option may be included in option menu 926based on a determination that at least one of one or more data items ofat least one selected one or more cells comprises a timestamp of eventraw data, and/or that at least one of selected one or more columnsrepresent data items comprising timestamps of a set of events.

Furthermore, context can be based on one or more data types assigned tothe selected portion(s) of the table format. Examples of data typesinclude numeric data types, categorical data types, and user defineddata types. A numeric data type may correspond to numbers and acategorical data type may correspond to a combination of numbers,letters, and/or other characters. A cell may be identified as comprisinga numeric data type or a categorical data type by the system analyzingthe data item represented in the cell. A column may be identified ascomprising a numeric data type or a categorical data type by the systemanalyzing at least some of the data items represented in the column(e.g., in cells). Such determinations may be made based on the selectionof the table format and prior to selecting an option, or could beperformed prior to the selection of the table format. Furthermore, insome cases, the data type could be selected by a user.

Thus, for example, an option may be included in option menu 926 based ona determination by the system that at least one of one or more dataitems of at least one of selected one or more cells is of a numeric datatype (e.g., based on the overall data type of the cell's correspondingcolumn, or based on the cell's particular data type), and/or that atleast one of selected one or more columns represent data items of anumeric data type. Similarly, an option may be included in option menu926 based on a determination that at least one of one or more data itemsof at least one selected one or more cells is of a categorical datatype, and/or that at least one of selected one or more of the columnsrepresent data items of a categorical data type. As an example, whereeach selected column has a numeric data type, an option may be presentedthat corresponds to one or more commands that apply at least onestatistical functions to the data items of the columns, and/or generatea graph where each axis represents a respective one of the columns. As afurther example, the one or more commands be operable to remove one ormore non-numeric cells from selected one or more cells and/or selectedone or more columns, where at least one non-numeric cell is detected ina selection.

As a further example, context can be based on a source of data items inthe selected portion(s) of the table format. For example, one or moreoptions may be included in or excluded from option menu 926 based on adetermination by the system that at least one of one or more data itemsof at least one of selected one or more cells comprises a statisticalvalue generated by one or more statistical functions performed on valuesof data items of at least some events and/or that at least one ofselected one or more columns represents data items comprisingstatistical values generated by one or more statistical functionsperformed on values of data items of at least some events. As anexample, the system may refrain from offering one or more optionsrelated to extracting new data items from data items that comprisestatistical values. A statistical value may refer to a value generatedfrom an event using one or more statistical functions (e.g., average,sum, mean, median, mode, standard deviation, variance, count, range),such that the value no longer corresponds directly to event raw data. Insome cases, a value may be determined as a statistical value based onidentifying the value as an output of a statistical command in a searchquery. For example, statistical commands may be commands known toproduce one or more statistical values an output.

As another example, one or more options may be included in or excludedfrom option menu 926 based on a determination by the system that atleast one of one or more selected one or more cells is an empty cell,and/or that at least one of selected one or more columns comprises oneor more empty cells. As an example, the system may offer one or moreoptions related to one or more commands that are operable to remove orotherwise perform some operation on empty cells based on a determinationthat a selection comprises at least one empty cell. Furthermore, one ormore options displayed for selections comprising empty cells may excludeone or more options otherwise displayed where the selection does notcomprise empty cells.

In further cases, one or more options may be included in or excludedfrom option menu 926 based on a determination by the system that atleast one of one or more data items of at least one of selected one ormore cells comprises multiple values, and/or that at least one ofselected one or more columns represents one or more cells comprisingmultiple values. A data item that comprises multiple values may comprisean array, matrix, or other representation of multiple values for asingle event attribute of a single event. Each value could be displayedin the same cell and may be displayed in a manner that indicates thevalues as being different values for the same event and event attribute.As an example, where a user selects a portion of a textualrepresentation of a data item in a cell, the system may offer or refrainfrom offering one or more options corresponding to one or more commands,based on whether the data item comprises multiple values.

In option menu 926, options 930 a and 930 b are examples of form-basedoptions, which include at least one form element that can be modified bya user. A form-based option may have at least some defaults entered intothe form. Examples of form elements that may be included in a form-basedoption include one or more of a text box, dropdown list, radio button,checkbox, and the like. Where an option corresponds to one or morecommands, a form element could be employed for selecting and/or enteringone or more command elements for a command and/or a command identifier(so as to select from the one or more commands). Optionally defaultcommand elements and/or command identifiers may be automatically enteredinto the form prior to or after selection of the option. An exemplaryform element could be a dropdown list that comprises a list ofpossibilities for command elements and/or command identifiers. Asanother example, a text box could be used to enter one or more commandelements of a command. The text box could comprise placeholder text thatis descriptive of a command element corresponding to the text box.

A form-based option may be selected by a user using a correspondingapply button, or other suitable means. For example, option 930 a couldbe selected by clicking on apply button 932 after providing input toconfigure the form, or optionally without configuration where the formcomprises one or more default values. An option, such as option 930 c,could be a nested form-based option, where option menu 926 comprises alink that can be selected by the user to open a form of the nestedform-based option. The form may open within or outside of option menu926 (e.g., replace the link with the form, expand the link to displaythe form, or appear outside of the option menu). The form couldsimilarly include an apply button to select the option. Option 930 d isan example of an option that does not include a form. As an example,option 930 d may be selected upon mouse up or mouse down. The optioncould include one or more default command elements. In addition, orinstead one or more of the command elements could be contextuallygenerated, for example, based on the user selection.

As described above, the system can cause one or more commands to beadded to a search query that corresponds to a group of events used topopulate the table format, based on a user selecting one of the optionsfrom the list of options. For example, upon a user selecting an option,the one or more commands could be automatically added to the searchquery. Where the search query employs a pipelined search language, theone or more commands can be added sequentially to the end of the searchquery. In implementations where the search query is displayed to theuser, for example, in a search bar, the one or more commands may beadded to the search bar. In implementations where the search query isrepresented by a command entry list (e.g., command entry list 808), thecommand entry list may be updated to represent the one or more commandsas one or more command entries.

The one or more commands that are added to the search query may be inproper syntax for the search query, complete with command identifiersand any command elements that are needed or desired for execution of thecommands. In some cases, one or more added command elements for acommand are default command elements associated with a selected option.Furthermore, one or more added command elements for a command could beprovided by the form of a form-based option. As another option, thecommand elements could be contextually generated based on the portion(s)of the table format selected by the user.

The one or more commands corresponding to an option can be contextuallybased on an event attribute that corresponds to a selected portion ofthe table format. For example, the event attribute can be used togenerate at least a portion of one or more of the commands for theoption. As an example, the event attribute, and/or one or more dataitems assigned to the event attribute can be incorporated into at leastone command element of one or more commands that correspond to theoption, or used to generate at least one value for the at least onecommand element. A reference to an event attribute (e.g., an attributelabel of the event attribute) or a data item (a value thereof), or datagenerated therefrom, could be included in a form element of an option asa default command element for a command. In addition, or instead, one ormore references (or values, or data generated therefrom) could beincluded as text in a command string added to the search query and usedto invoke a command. The command string can include a command identifieralong with the reference(s), value(s), or data generated therefrom, usedfor a command element. As one example, a command element that is basedon the event attribute may be a command element that instructs thecommand as to which event attribute and/or data item or items assignedto an event attribute to operate on, for example, within events inputinto the command.

Thus, where a user selects a column, one or more commands for an optionmay be based on (e.g., generated using) any event attributescorresponding to the column. For example, at least one command elementmay be generated from the event attribute(s) and/or one or more dataitems that are assigned to the event attribute(s), or values thereof. Asan example, the user could select column 804 a, as in FIG. 8C. A commandelement for a command corresponding to an option in option menu 826 bcould instruct the command to operate on data items of an eventattribute having the attribute label _time, based on column 804 acomprising the event attribute, or could provide data generated from oneor more of the data items as input to the command. Similarly, a usercould select both columns 804 b and 804 c, as in FIG. 8D. A commandelement of a command corresponding to an option in option menu 826 ccould instruct the command to operate on at least some data items of theevent attributes having the attribute labels of source and host, basedon columns 804 b and 804 c respectively comprising those eventattributes, or could provide data generated from one or more of the dataitems as input to the command.

For a cell, the user could select cell 810, as in FIG. 8B, and a commandelement of a command corresponding to an option in option menu 826 acould be generated to instruct the command to operate on the data itemassigned to the event attribute having the attribute label referer, touse the value of that data item as an input to the command, or togenerate data from the value of the data item as an input to thecommand, each based on cell 810 corresponding to a data item assigned tothe event attribute.

For text, the user could select portion 814 of textual representation812, as in FIG. 8F, and a command element of a command corresponding toan option in option menu 826 e could be generated to instruct thecommand to operate on at least the portion of the text in the data itemassigned to the event attribute having the attribute label “_raw,” touse at least the portion as an input to the command, or to generate databased on the portion as an input to the command (e.g., a keyword thatincludes the portion), all based on portion 814 being in a data itemassigned to the event attribute.

As discussed above, based on the selection of one or more displayedoptions, operations corresponding to a displayed option that is selectedby the user can then be carried out by the system. As one example, whenan option is selected (e.g., in option menu 926), the operations may beautomatically performed. Furthermore, the screen can be updated based onany changes corresponding to the selected options. For example, insearch screen 800, when a user selects an option, the set of eventsutilized to populate table format 802 (e.g., a search results set) maybe automatically updated by the operations associated with the option.As an example, one or more portions of a search query could be executed,as needed to accurately portray events corresponding to the search queryin the table format. Furthermore, the displayed table format 802 may beautomatically updated to reflect changes to the set of events. Moreparticularly, where one or more commands are added to a search query, orthe search query is otherwise modified by an option, table format 802can be automatically updated to correspond to the modified search query.This could result in more or fewer events being included in the tableformat, and/or more or fewer event attributes being included in thetable format, depending on the commands.

Thus, for example, a user may directly interact with the table format tomanipulate a corresponding search query and automatically see theresults of the manipulations reflected in the table format. In doing so,the user need not necessarily directly code the search query, which canrequire extensive knowledge of the underlying search query language.Instead, complicated aspects of coding the search query can be embeddedin the options, and results of the options (and any underlying commands)can quickly be portrayed to the user. For example, the user could selectan option to remove a column comprising an event attribute, and acommand assigned to the option that operates to filter the eventattribute from inputted events can automatically be added to the searchquery. At least the added command could automatically be executed, andthe displayed table format could be updated to no longer include thecolumn, as the event attribute would be excluded from search results.

It should be noted that execution of a search query (or one or moreportions thereof), as described herein can comprise an automaticreformulation of the search query (or one or more portions thereof), soas to more efficiently achieve equivalent search results as the searchquery.

Below, various potential options are described with respect to userselections of a table format. Although options may be described ascorresponding to a single command, similar functionality may be achievedutilized multiple commands. It is further noted that an omission of aparticular option type from a particular option menu is not intended tolimit the option from potentially being included from the option menu.As an example, although extraction type options are only shown in optionmenu 826 e of FIG. 8F, similar options are contemplated as beingincluded for extracting new fields for option menus 826 a, 826 b, 826 c,and 826 d.

In FIG. 8B, option menu 826 a is shown as including two options. Thefirst option corresponds to a command that is operable to filter outeach event input into the command that does not include the value“hdp://www.buttercupgames.com/productscreen?productid=5F-BV5-G01” for adata item of an event attribute labeled “referer.” The value andattribute may be provided to the command from the value and eventattribute associated with the user selection. The second option issimilar to the first option, but filters out each event input into thecommand that does include the specified value.

In FIG. 8C, option menu 826 b is shown as including sixteen options,with a filter text box at the top. The filter text box can be used tofilter out events input into a command that do not include any keywordsentered into the text box by a user. Those keywords may be incorporatedinto the command. The first option may be similar to the first option inoption menu 826 a, where the value may be entered by the user.

The second option is associated with a command that is operable toremove events input into the command that contain an identicalcombination of values for an event attribute. The event attribute may beprovided to the command as the event attribute associated with theselected column.

The third option may correspond to a command that is operable to sortthe events input into the command in ascending order of values for anevent attribute, where the event attribute may be provided to thecommand as the event attribute associated with the selected column.

The fourth option is similar to the third option, but sorts the eventsin descending order of the values.

The fifth option corresponds to a command that is operable to change theattribute label of an event attribute for an associated column. Theevent attribute may be provided to the command as the event attributeassociated with the selected column. Furthermore, the new attributelabel for the command may be entered into the text box by a user.

The sixth option corresponds to a command that is operable to remove anevent attribute from events input into the command. The event attributemay be provided to the command as the event attribute associated withthe selected column.

The seventh option corresponds to a command that is operable to removeevents input into the command that have an empty cell, or no value, fora given event attribute of events. The event attribute may be providedto the command as the event attribute associated with the selectedcolumn.

The eight option corresponds to a command that is operable to apply alookup table to changes values for a given event attribute of events.The event attribute may be provided to the command as the eventattribute associated with the selected column.

The ninth option corresponds to a command that is operable to extractall fields discovered within data items for a given event attribute ofevents. Such an option is later described in additional detail. Theevent attribute may be provided to the command as the event attributeassociated with the selected column.

The tenth option corresponds to a command that is operable to split agiven event attribute for events input to the command into one or moreother event attributes (e.g., resulting in additional columns). Theevent attribute may be provided to the command as the event attributeassociated with the selected column.

The eleventh option corresponds to a command that is operable toevaluate an expression for each value of a given event attribute forevents input into the command and assign the resulting value to an eventattribute for the event that had its value evaluated. The eventattribute may be provided to the command as the event attributeassociated with the selected column. Furthermore, a user may use thefirst text box to specify an attribute label for the resulting value anduse the second text box to specify the evaluation expression, which areused as command elements in the command. If an event attribute alreadyexists that has the attribute label entered by the user, that eventattribute may optionally be overwritten with the resulting values.

The twelfth option corresponds to a command that is operable to findtransactions based on events input to the command that meet variousconstraints. Events may be grouped into transactions based on the valuesof a given event attribute. The event attribute may be provided to thecommand as the event attribute associated with the selected column.Furthermore, a user may use the first text box to specify a max pausevalue for the command and use the second text box to specify a max spanvalue for the command. The maxspan constraint requires the transaction'sevents to span less than maxspan. The maxpause constraint requires therebe no pause between a transaction's events of greater than maxpause.

The thirteenth option corresponds to a command that is operable todisplay the most common values for a given event attribute in a set ofevents input to the command. The event attribute may be provided to thecommand as the event attribute associated with the selected column.

The fourteenth option corresponds to a command that is similar to thecommand of the thirteenth option, but groups the top values by the eventattribute having the attribute label “_time.”

The fifteenth option corresponds to a command that is operable todisplay the least common values for a given event attribute in a set ofevents input to the command. The event attribute may be provided to thecommand as the event attribute associated with the selected column.

The sixteenth option corresponds to a command that is operable toprovide statistics on values for a given event attribute in a set ofevents input to the command grouped by the event attribute having theattribute label “host.” The given event attribute may be provided to thecommand as the event attribute associated with the selected column.

In FIG. 8D, option menu 826 c is shown as including five options. Thefirst option corresponds to a statistical command that is operable toperform a summation of values of events input to the command for a firstevent attribute grouped by a second event attribute. The first andsecond event attributes may be provided to the command as the eventattributes associated with the selected columns. Such a command mightonly be included in option menu 826 c where at least one of the selectedcolumns is of a numerical data type (e.g., where one is of a numericaldata type and another is of a categorical data type). Furthermore, theevent attribute associated with a selected column having a numericaldata type may be used as the first event attribute and the eventattribute associated with a selected column having a categorical datatype may be used as the second event attribute.

The second option corresponds to a command that is similar to thecommand of the first option, but is operable to perform an averagerather than a summation.

The third option corresponds to a command that is operable to correlatevalues between event attributes of events input to the command to showthe co-occurrence between the values. The command may build acontingency table, comprising a co-occurrence matrix for the values ofthe event attributes. The event attributes may be provided to thecommand as the event attributes associated with selected columns.

The fourth option corresponds to a command that is operable to correlateevent attributes of events input to the command to show theco-occurrence between the event attributes. The event attributes may beprovided to the command as the event attributes associated with selectedcolumns.

The fifth option corresponds to a command that is operable to filter outall event attributes from events input to the command except for givenevent attributes. The given event attributes may be provided to thecommand as the event attributes associated with selected columns.

In FIG. 8E, option menu 826 d is shown as including five options. Thefirst option corresponds to a command that is operable to count thenumber of events input into the command.

The second option corresponds to a command that is operable to count thenumber of events input into the command by the event attribute havingthe attribute label “_time.”

The third option corresponds to a command that is operable to transposeevents input to the command and event attributes of the commands, suchthat each row may become a column.

The fourth option corresponds to a command that is operable to returnthe first N events input to the command where N is a positive integer(e.g., 10).

The fifth option corresponds to a command that is operable to return thelast N events input to the command where N is a positive integer (e.g.,10).

In FIG. 8F, option menu 826 e is shown as including six options. Thefirst option corresponds to a command that is operable to filter outevents input to the command that do not include a given keyword orphrase for a given event attribute. The given event keyword or phrasemay be provided to the command as identified from at least a selectionportion of the textual representation of a data item, and the givenevent attribute can be provided by the event attribute associated withthe data item.

The second option corresponds to a command that is similar to the firstoption, but removes events that do not include the given keyword orphrase for the given event attribute.

The third option corresponds to a command that is similar to the firstoption, but removes events that do not start with the given keyword orphrase for the given event attribute.

The fourth option corresponds to a command that is similar to the firstoption, but removes events that do not end with the given keyword orphrase for the given event attribute.

The fifth option is operable to initiate a field extraction workflow forextracting one or more new fields.

The sixth option corresponds to a command that is operable to extract anew field having a given field label from a given event attribute forevent input to the command. The given field label may be generated fromthe selected portion of the textual representation of a data item, andthe given event attribute can be provided by the event attributeassociated with the data item. Such an extraction may be a suggestedfield extraction, later described in additional detail below.

2.4 Command Entry List

In some respects, the present disclosure relates to a command entrylist, an example of which was briefly discussed with respect to commandentry list 808. Command entry list 808 corresponds to an exemplaryimplementation of a command entry list in a search screen of a searchsystem. However, concepts related to a command entry list are notintended to be specifically tied to such implementations. To thiseffect, command entry lists are discussed in additional detail belowwith respect to FIG. 10 and command entry lists 1008 a and 1008 b.

Command entry lists 1008 a and 1008 b each represent potentialimplementations of command entry lists, in accordance with conceptsdisclosed herein. Command entry lists 1008 a and 1008 b each comprise alist of command entries, which can be displayed in a search interface(such as is command entry list 808), or other interface. As shown,command entry lists 1008 a and 1008 b each comprise command entries 1040a, 1040 b, 1040 c, and 1040 d. Although the command entries are listedin a vertical column (with one command entry per row), other listformats could be employed.

Each command entry in a command entry list may represent one or morecommands of a plurality of commands of a search query. By way ofexample, FIG. 10 shows search query 1044 which may corresponds to eachof command entry lists 1008 a and 1008 b. Command entry 1040 acorresponds to commands 1044 a, command entry 1040 b corresponds tocommand 1044 b, command entry 1040 c corresponds to command 1044 c, andcommand entry 1040 d corresponds to command 1044 d, by way of example.

As shown, the list of command entries of command entry lists 1008 a and1008 b are displayed in a sequence corresponding to the plurality ofcommands of the search query. In particular, the command entries aredisplayed in the list in the same sequence as their correspondingcommands appear in the search query. As the search query utilizes apipelined search language in the present examples, each command entrythat corresponds to a command may be considered a data processing pipeand the sequencing can portray to the user the relationship betweencommands in terms of inputs and outputs for the data processing pipes.It is noted that, the display in the sequence could be visually conveyedusing a variety of possible approaches, such as by depicting acombination of alphanumeric characters proximate to each command entry,and/or the by the positioning of the command entries on screen.Furthermore, in some implementations, the list of command entries of acommand entry list need not be displayed in a sequence corresponding toa plurality of commands of a search query in every implementation of thepresent disclosure.

Command entries 1040 b, 1040 c, and 1040 d each display a representationof their respective underlying commands. In the approach depicted incommand entry list 1008 a, each command is listed as the command wouldappear in search query 1044. Pipes (e.g., “|”) or command separators,are omitted from display, and may be implied from the depiction of thecommand entries. However, in some implementations, command separatorsmight be depicted, or a subset of command separators might be depicted,for example, within a command entry that corresponds to multiplecommands. In the approach depicted in command entry list 1008 b, variousportions of commands are formatted in different manners, to improvelegibility for users. For example, command identifiers are followed bycolons and are aligned to the colons, and might be bolded. Commandelement parameters are formatted in a distinguishable manner using adifferent color of text than other portions, and command modifiers aredistinguishable as unformatted text. Command variables are depicted intext boxes.

In some respects, through interaction with a command entry list, a usercan modify the search query. For example, one to all of the commandentries can correspond to a respective form for modifying its respectiveunderlying commands in the search query. In the approach depicted incommand entry list 1008 a, text of any portion of a command may bemodified. For example, each command entry comprises a text box thatincludes the command. A user may modify the command by modifying thetext in the text box. The corresponding command in search query 1044 canbe updated accordingly to correspond to the modified command. Thus, auser could change “limit=10” in command entry 1040 d to “limit=20,” andcommand 1044 d may be modified to reflect the changes made using commandentry 1040 d. Such changes may be reflected automatically, or may firstrequire the user to apply the changes.

In the approach depicted in in command entry list 1008 b, portions ofthe commands are represented by a respective form element. Users mayoptionally be restricted from modifying at least some portions of thecommands in the command entries, such as command identifiers.Furthermore, some portions of the commands may have respective dropdownlists, or option menus, associated therewith that can be used to selectfields, aggregation methods, or other command parameters to be used asthe portion of the command. The options presented for a given portion ofa command may be included based on the type of command element suitablefor the position of the given portion in the command. As shown, count,referrer, host, and remove all have corresponding option menus,indicated as rounded rectangular boxes (e.g., 1041 in FIG. 10).

In some cases, a user interaction with the command entry list may breaka dependency of a command element(s) of one or more command entries. Forexample, a user could change “field—_raw” in command entry 1040 b to“field—host” and command 1044 b may be modified to reflect the changemade to command entry 1040 b. In the present example, “_raw” and “host”are used as command elements that instruct the command having commandidentifier “field” as to which event attribute to operate on. Whenexecuted, data items of the event attribute may be removed from eventsinput into the command. Thus, due to the modification “_raw” data itemsmay no longer be removed, but “host” data items may be removed instead.However, as shown, command entry 1040 c has a command elementinstructing the command to operate on an event attribute referenced by“host.” In some implementations, in response to the user adding “host”to command entry 1040 b, the system may optionally detect that themodification to command entry 1040 b breaks a dependency of the commandelement (e.g., event attribute) referenced in command entry 1040 c andautomatically throw that command entry into an error state. In the errorstate, the commands associated with the command entry may be excludedfrom execution in the search query and a visual indication may bedisplayed to the user that the command entry is in the error state.

Although some modifications may throw one or more command entries intoan error state, in some cases, a broken dependency caused by a userinteraction may be automatically identified and corrected in the searchquery. For example, assume that a first command entry represents acommand in a search query that is executable to extract a new field froman event attribute and names that field “referer.” The command mayinclude a command element “referer,” which instructs the command tolabel the new field “referer.” Also assume that a second command entryrepresents a subsequent command in the search query that is executableto operate on a field labeled “referer.” In accordance withimplementations of the present disclosure, the system may automaticallydetect a dependency between the commands of the command entries when auser renames “referer” through interaction with the first command entry.Based on detecting the dependency, the system may automatically renamethe command element (e.g., event attribute) in the command(s)represented by the second command entry (and potentially any otherdependent commands in the search query) to correspond to or match therenamed command element represented by the first command entry. Thus,where a user interaction comprises a user renaming a command element inone or more commands using a form element in a designated command entrythat represents the command element, and one or more other commandelements in one or more other commands can be automatically renamed inthe search query so as to correspond to the renamed command element. Inthis way, error states can be avoided for command entries representingcommands that include command elements that depend on (e.g., reference)command elements of other commands.

The approach depicted in command entry list 1008 b may be similar tocommand entry list 1008 a, but with only designated portions of acommand being directly modifiable by a user, while at least someportions are not directly modifiable by the user. By way of example,command identifiers are not directly modifiable through the depictedcommand entries. However, as indicated using underlining, commandvariables are directly modifiable as text boxes. Command elementparameters may optionally be modifiable using respective dropdown lists,as one example.

As shown in FIG. 10, each command entry has one or more correspondingselectable options to modify the command entry list with respect to thecommand entry. The selectable options are accessible through respectiveform elements. As an example, in each of command entry lists 1008 a and1008 b, command entries 1040 b, 1040 c, and 1040 d each compriserespective options 1042 a, 1042 b, and 1042 c. The options for a commandentry are selectable for the command entry by way of one or morerespective form elements, which are visually and operably associatedwith the command entry. In command entry list 1008 a, two form elementsare employed for each of command entries 1040 b, 1040 c, and 1040 d. Inparticular, a button (e.g., x-button), and dropdown list are includedfor each command entry. The option corresponding to the button (which inother implementations could be selectable in some other manner) incommand entry list 1008 a is operable to delete at least thecorresponding command entry from command entry list 1008 a. Similarfunctionality may be incorporated into the options, as shown in commandentry list 1008 b.

Deleting the corresponding command entry may automatically shiftpositions of the subsequent command entries in the command entry list tofill the gap left by deleting the command entry, while otherwiseretaining sequencing of the command entries in the command entry list.Furthermore, deleting the command entry may delete (e.g., automatically)the one or more commands that correspond to the command entry fromsearch query 1044 (and optionally one or more command separators).Similar to the command entries, any subsequent commands in the searchquery may have their sequencing retained, with a command thatimmediately preceded any deleted command(s) being configured to receivethe input that would otherwise had been provided to the deletedcommand(s). Thus, through selection of the option, both the search queryand the command entry list may be updated.

As other potential options, the options for a command entry can beselectable to reorder the command entry within the command entry list.One exemplary reorder option is a shift up option, which is operable toswap positions of the command entry associated with the option with thecommand entry immediately preceding the command entry in the list.Swapping a position of the command entry may automatically swap positionof the one or more commands represented by the associated command entrywith the one or more commands represented by the immediately precedingcommand entry in search query 1044. Another example of a reorder optionis a shift down option, which is similar to the shift up option with theimmediately preceding command entry being substituted with theimmediately following command entry for swapping. It will be appreciatedthat other reordering options are possible, and each may comprisemodifying the sequencing of command entries in the command entry listand modifying the search query to reflect corresponding changes.Furthermore, in some cases, a user may interact with the command entrylist by selecting a command entry (e.g., using a mouse), and draggingthe command entry to a different position in the command entry list,thereby reordering the command entry list.

In addition to command entries, a command entry list may include a blankentry, such as blank entry 1050. Blank entry 1050 is operable to add newcommand entries to the command entry list. In command entry list 1008 a,blank entry 1050 comprises a form that is operable by a user to input acommand into blank entry 1050. In the example shown, the form comprisesa text box for inputting the command as text, although other formelements could be employed. As shown, the text box is created withplaceholder text that reads “Add new pipe . . . ” and may be utilized toapply blank entry 1050, with a command entered therein by a user, tocommand entry list 1008 a as a new command entry and/or to include thecommand entered therein in search query 1044 (e.g., add the new commandentry to the end of the list of command entries and/or add the newcommand(s) to the end of the search query). One or more associatedoptions 1052 may be incorporated into one or more form elements inaddition to or instead of the text box. Options 1052 may provide a menuof commands that a user can add to the command entry list to create anew command entry by selecting its associated option.

It should be noted that changes made to the command entry list using aform element may be applied to the search query as part of operationsassociated with the form element or the form containing the form element(e.g., automatically). However in some implementations, the user maymake multiple changes to command entries or sequencing of the commandentries in the command entry list, and the changes are individually orcollectively applied to the search query by the user, for example, usingone or more apply buttons, and/or save features.

In FIG. 10, command entry 1040 a is an input command entry. An inputcommand entry can optionally be included in a command entry list andcorresponds to an input query (e.g., 1044 a), or pipeline, which servesas an input to the subsequent commands of the search query. Therefore,an input command entry may be the first command entry in a command entrylist, if present. The input command entry may be permitted to representmore than one command, while command entries 1040 b, 1040 c, and 1040 dmay optionally be restricted to representing single commands. One ormore commands corresponding to an input command entry may optionally behidden from display in the interface and/or the command entry list(although they may optionally be capable of being revealed in somemanner). Furthermore, the interface and/or the command entry list mayrestrict the user from directly modifying the commands represented bythe input command entry.

In some implementations, an input command entry corresponds to a savedinput query or pipeline that is selected by the user as an input. “WebLogs” in FIG. 10 is an example of a label corresponding to a saved inputquery or pipeline that can be displayed with the command entry list. Theuser can optionally be permitted to selectively replace the saved inputquery with a different input search query (e.g., another saved query)through the interface comprising the command entry list. As an example,form element 1056 could comprise an option operable to initiate such aselection. It should be appreciated that search query 1044 can beupdated accordingly to replace commands of a previous input search query(e.g., commands 1044 a) with a newly selected input search query orpipeline.

From the foregoing, it should be appreciated that one or more commandentry lists can be employed to create and/or modify a search query. Itis further noted that, command entry lists can be incorporated intointerfaces that allow search queries to be created and/or modified usingadditional means. Command entry list 808 in FIG. 8A is one such examplewhere, as described above, a user may modify or create the search query,for example, through interactions with table format 802, or possiblyusing a search bar. Thus, the search query described with respect tosearch screen 800 could correspond to search query 1044 of FIG. 10.

In these cases, where the search query is modified through tableinteractions, the search bar, or other means, the changes may bepropagated to the command entry list (automatically or otherwise). Toillustrate the foregoing, when a user selects an option, such as one ofthe options in option menu 926, one or more commands corresponding tothe option can be automatically added to the end of command entry list808 as a command entry. In some cases, where the option is a form-basedoption, the form corresponding to the option might be reproduced in thecommand entry, as completed by the user. In particular, each of commandentries 1040 b, 1040 c, and 1040 d in command entry list 1008 b couldcorrespond to a form of a respective option previously selected by auser. The form elements utilized for creation and/or modification of thecommand in the form of the option can be reproduced, as shown.

2.5 Exemplary Pipeline Selection Interface

In further respects, implementations of the present disclosure relate todata processing pipelines (or simply pipelines) that are defined by oneor more search queries. A data processing pipeline can correspond to aset of sequenced commands configured such that inputs to the pipelineare operated on by a first command in the sequence, and each subsequentcommand operates on results produced by the preceding command in thesequence, until a final command in the sequence provides one or moreoutputs to the pipeline. The sequence of the commands can be defined bya search query, such as by using a pipelined search language like SPL.

In various implementations, a search query can be created that defines adata processing pipeline that extends another data processing pipeline,which itself may be defined by a search query. In some cases, to createsuch a search query, one or more data processing pipelines can beselected as a basis for the search query (e.g., as an input search queryor pipeline, as described above). In doing so, the full search queryneed not be created (e.g., by a user), instead, only an additional querymay be defined that corresponds to an extended portion of the selecteddata processing pipeline(s).

In some implementations, a user can select the one or more saved dataprocessing pipelines as a basis for the search query using a selectioninterface. The selection interface could optionally be displayed withanother interface, such as a search interface, in the same screen as theother interface, or in a different screen. An example of a suitableselection interface is described with respect to selection interface1100 of FIG. 11.

As shown, selection interface 1100 comprises a plurality of pipelineentries, such as pipeline entries 1102 a and 1102 b, which are listed inselection interface 1100. Each pipeline entry represents a savedpipeline (e.g., a persistently stored pipeline) and displays a pipelinelabel assigned to the saved pipeline. For example, pipeline entry 1102 ahas pipeline label 1104 a that reads “All Data,” and represents arespective saved pipeline that could optionally serve as a basis for allother pipelines. As another example, pipeline entry 1102 b has pipelinelabel 1104 b that reads “Web Logs,” and represents a respective savedpipeline. Each saved pipeline can represent a saved search query thatdefines the saved pipeline. As an example, the saved pipelinecorresponding to pipeline entry 1102 b can represent a saved searchquery comprising commands 1044 a of FIG. 10, by way of example.

Each pipeline entry is selectable to load the saved pipeline thatcorresponds to the pipeline entry. For example, each pipeline entry canhave one or more links that are selectable to load the correspondingpipeline. In the example shown, two links are included for each pipelineentry, which are “edit pipeline” links and “use as input” links. Asshown, pipeline entry 1102 a comprises edit pipeline link 1108 a and useas input link 1106 a and pipeline entry 1102 b comprises edit pipelinelink 1108 b and use as input link 1106 b.

To this effect, in some implementations, a user may assign one or moretags to any pipeline entry. As an example, pipeline entry 1102 a has anassigned “data set” tag. Other tags for other shown include “mine,”“accelerated,” and “lookup.” A user can filter out pipeline entries fromselection interface 1100 based on their assigned tags. For example,filter form 1112 can be used to select which tag(s) pipeline entriesshould have to be included in selection interface 1100. As anotherpossible feature, each pipeline entry has a down chevron, which isselectable to show configuration settings for that pipeline entry. Asshown, the pipeline entry with a pipeline label that read “Errors in thelast 24 hours” has been selected, and thereby expanded to show itsconfiguration settings. Some of the configuration settings may bechanged through selection interface 110, such as those shown asincluding “Edit” links that may be selected to edit a correspondingsetting.

In response to a user selecting an edit pipeline link, the system maycause the corresponding pipeline of the pipeline entry to be loaded forediting. By selecting edit pipeline link 1108 b, for example, a savedpipeline corresponding to commands 1044 a in FIG. 10 could be loadedinto an interface where the user may modify the pipeline. Loading asaved pipeline may comprise loading at least some of a saved searchquery corresponding to the saved pipeline. Thus, commands 1044 a couldbe loaded into an interface. A user may modify at least a portion of thesaved search query by adding, deleting, and/or modifying one or morecommands of the pipeline using the interface.

The saved pipeline may be loaded into a search interface, which maycorrespond to search screen 800, as one example. Thus, the savedpipeline could be used as the search query described above that can bemodified using the search interface. In addition, or instead, the savedpipeline could be loaded as the search query described above as beingmodified using a command entry list by populating the command entry listwith command entries representing the saved pipeline. However, the savedpipeline may be loaded into other interfaces, which may still implementan interactive table format or command entry list, as described above,or another type of interface. The interface may or may not displayevents that correspond to the search query. In implementations where theevents are displayed, upon loading the saved pipeline, events may beloaded and/or displayed that correspond to the saved pipeline (e.g., anoutput data set of the saved pipeline).

The events could be loaded by optionally executing the saved pipeline.However, in some implementations, the events could be loaded from anexisting data set corresponding to the saved data pipeline. In somecases, the data set may be saved (e.g., persistently) in associationwith the saved data pipeline and may correspond to an output data set ofthe saved data pipeline. A saved data set could be saved as a table, orin another format. By loading the saved data set, the saved pipelineneed not be executed to load the events, thereby saving systemresources. Furthermore, where one or more commands are added to thesaved pipeline, the one or more commands may use the data set as aninput data set for further processing, rather than executing the entirepipeline.

Any modifications that may have been made to the loaded pipeline may besaved, for example, to the saved pipeline, such that the saved pipelineis updated to correspond to the modified search query (the save processmay be initiated by the user, for example, by selecting a save option inthe interface). Furthermore, an updated output data set may be saved inassociation with the updated saved pipeline, which may replace apreviously saved data set. The updated saved pipeline and/or updatedsaved data set may then be accessed using the pipeline entry in theselection interface, for example, through edit pipeline link 1108 b oruse as input link 1106 b.

In response to a user selecting a use as input link, the system maycause the corresponding pipeline of the pipeline entry to be loaded asan input pipeline for an existing search query, or as a basis for a newpipeline that may be created based on the input pipeline. By selectinguse as input link 1106 b, for example, a saved pipeline corresponding tocommands 1044 a in FIG. 10 could be loaded into an interface forcreating and/or modifying a search query that builds on, or extends, thesaved pipeline. Loading a saved pipeline may comprise loading at leastsome of a saved search query corresponding to the saved pipeline. Thus,commands 1044 a could be loaded into the interface. A user may possiblydelete and/or modify the loaded one or more commands using theinterface. However, in some cases, the one or more commands may behidden from the user and/or the interface may preclude the one or morecommands from being modified (e.g., as a default that may be overriddenby the user). Furthermore, the user may be precluded from modifying theunderlying saved pipeline using the interface (at least directly).

The saved pipeline may be loaded into a search interface, which maycorrespond to search screen 800, as one example. Thus, the savedpipeline could be used at least as a basis for the search querydescribed above that can be modified using the search interface. Inaddition, or instead, the saved pipeline could be loaded as at least abasis of the search query described above that may be modified using acommand entry list by populating the command entry list with one or morecommand entries representing the saved pipeline. However, the savedpipeline may be loaded into other interfaces, which may still implementan interactive table format or command entry lists, as described above,or another type of interface. In implementations where the events aredisplayed, upon loading the saved pipeline, events may be loaded and/ordisplayed that correspond to the saved pipeline (e.g., an output dataset of the saved pipeline).

The events could be loaded by optionally executing the saved pipeline.However, in some implementations, the events could be loaded from anexisting data set corresponding to the saved data pipeline. In somecases, the data set may be saved (e.g., persistently) in associationwith the saved data pipeline and may correspond to an output data set ofthe saved data pipeline. By loading the saved data set, the savedpipeline need not be executed, thereby saving system resources.Furthermore, where one or more commands are added to the saved pipeline,the one or more commands may use the data set as an input for furtherprocessing, rather than executing the entire pipeline.

In various implementations, one or more commands can be added to and/oredited in a search query that builds off of, or extends, the loadedsaved pipeline (e.g., commands 1044 a). The search query may correspondto the saved pipeline (e.g., commands 1044 a), with an additional searchquery that builds off of the saved pipeline. One such example is searchquery 1044 in FIG. 10, with the additional search query comprisingcommands 1044 b, 1044 c, and 1044 d that might have been added usingcommand entry list 1008 a or 1008 b. As another example, the additionalsearch query may have been added using a combination of command entrylist 808 and interactions with table format 802, where the interfacecorresponds to search screen 800. Where updated events are needed fordisplay, the updated events may be generated based on the output dataset of the loaded saved pipeline, for example, by executing theadditional search query using the output data set as an input, therebysaving system resources. Furthermore, by preventing the user frommodifying the loaded pipeline in the interface, it may be ensured thatthe output data set can be used regularly for this purpose.

The constructed search query may be saved, for example, as a new savedpipeline that corresponds to the search query (the save process may beinitiated by the user, for example, by selecting a save option in theinterface). Furthermore, an output data set may be saved in associationwith the new saved pipeline that corresponds to an output of thepipeline. Additionally, the constructed search query can be saved inassociation with the saved pipeline and a new pipeline entry. The savedpipeline may then be accessed, for example, in selection interface 1100using an associated use for input pipeline link and an associated editpipeline link in the pipeline entry, similar to web logs.

2.6 Dependent Pipelines

In some respects, the present disclosure relates to creating adependency between a first search query and a second search query, wherethe first search query defines a first data processing pipeline and thesecond search query defines a second data processing pipeline thatextends the first data processing pipeline. The system can detect amodification to the first data processing pipeline defined by the firstsearch query, and based on the modification of the first data processingpipeline being detected, enforce the dependency, such that the seconddata processing pipeline is modified to extend the modified first dataprocessing pipeline.

In the context of the previous example, a dependency may be createdbetween the saved pipeline (input pipeline) and the new pipeline beingmodified in the interface, where the first search query is the querycorresponding to the saved pipeline and the search query being createdcorresponds to the second search query. In some cases, the modificationthat is detected could be performed while a user is modifying the firstsearch query using an edit pipeline link, as one example. For example,the user could be modifying the first search query and creating the newpipeline concurrently (e.g., in different tabs). By enforcing thedependency, the new pipeline is modified to still extend the modifiedfirst data processing pipeline (e.g., automatically). As an example, thechanges made to the first search query may be incorporated into the basepipeline being used to construct the new pipeline. In some cases, anon-persisted data set that corresponds to an output of the modifiedfirst search query (e.g., generated while modifying the first searchquery) could be used as an input to the additional search query, suchthat only the additional search query needs to be executed. As a furtherexample, such a dependency may only be detected and/or enforced based onthe modified first search query being saved by the user to update thesaved pipeline (e.g., persistently).

As another example, in the context of the previous example, a dependencymay be created between the saved pipeline and the newly saved pipeline(e.g. associated with the new pipeline entry), where the first searchquery is a query corresponding to the saved pipeline that served as abasis for the newly saved pipeline, and the second search query is aquery corresponding that the extended saved pipeline. The modificationthat is detected could be performed using an edit pipeline link, as oneexample. Furthermore, the modification could correspond to an update tothe saved pipeline that serves as a basis for the dependent pipeline.The dependency can be enforced so as to ensure that when a user selectsthe dependent pipeline for editing, or as an input pipeline, thepipeline that is loaded extends the updated saved pipeline.

Dependencies can be created and/or saved at any suitable time, such asbased on a user selecting to save a pipeline. As another option, thedependency may be created and/or saved in response to the user selectinga saved data processing pipeline as a basis for the new pipeline (e.g.,prior to any saving of the new pipeline). Furthermore, dependencies canbe enforced at any suitable time. As an example, dependencies and beenforced at load time (e.g., using selection interface 1100), at savetime (e.g., a user selected save process), or during query modification(e.g., using search screen 800).

It is noted that multiple pipelines may be created that extend that samebase pipeline. Thus, dependencies may exist for each of these pipelines,such that changes to the base pipeline are propagated to the dependentpipelines. In this way, a user may only need to modify the basepipeline, instead of having to individually modify the other pipelines.Furthermore, each dependent pipeline may optionally apply its ownadditional processing to the same output data set produced by the basepipeline, without necessarily having to execute the base pipeline eachtime, as one example. Such features may be especially beneficial wherethe pipelines are used to apply a late-binding schema.

It is further noted that pipelines can be created that extend apipeline, which itself extends a base pipeline. In such a case, apipeline may have multiple dependencies, thereby creating a chain ofsaved pipelines. It is further noted that one pipeline can extend morethan one base pipeline. In such a case, the pipeline may also havemultiple dependencies. For example, the base pipelines could correspondto a combination of the base pipelines that may act to join, transact,or otherwise mix the pipelines in processing.

2.7 Extracting Field Label-Value Pairs

In some respects, the present disclosure relates to various approachesfor extracting field label-value pairs from data items of events, suchas event raw data, extracted fields, metadata, or other data items thatmay be assigned to one or more events. These approaches are useful incombination with some implementations described herein, such as varioussearch interfaces. For example, various aspects of these approaches maybe incorporated into at least one of the options that may be presentedbased on a user selecting a portion of a table format, which may be oneof the options in option menu 926 (e.g., as one or more commands).However, it is noted that these approaches are more generally useful inthe context of analyzing and/or interacting with events, which mayoptionally be facilitated by a graphical interface for displaying theevents.

Extracting a field label-value pair from an event can generally refer toa process whereby a field label and a value associated with the fieldlabel are identified from the content of an event, such as event rawdata of the event, or another event attribute, as a field label-valuepair. Extractions of field label-value pairs can be implementedutilizing extraction rules that are applied to data in the events toextract values for specific fields as data items for the fields. In thecontext of extracting field label-value pairs, an extraction rule for afield can include one or more instructions that specify how to extract avalue for the field from event data and further how to identify and/orextract a field label for the value from the event data. In some cases,an extraction rule comprises one or more regular expressions to provideinstructions for identifying a field label and/or value. The field labelmay optionally be assigned to the field.

An extraction rule for extracting field label-value pairs can generallyinclude any type of instruction(s) for identifying and extracting valuesand for identifying and/or extracting a field label corresponding to anyextracted values, from data in events. The field label may optionally begenerated from the data in the events. In contrast, other extractionrules may only provide instructions for identifying and extractingvalues from data in events. A field label may be manually entered for afield associated with the values.

An example of an extraction rule for extracting field label-value pairsis a rule that identifies a field label for a field based on text on theleft hand side of an equal sign (“=”), and identifies a value for a newdata item or value associated with the field label based on text on theright hand side of the equal sign within a value of a data item. Theequal sign can be used to demarcate text representing a field label andtext representing a value associated with that field label. Theidentified text on each side of the equal sign could further bedemarcated by a space character (“ ”). It should be noted that otherdemarcating character(s) could be employed in addition to, or instead ofequal signs and space characters to define text representing a fieldlabel and/or value associated with the field label, such as one or morecolons, back slashes, ampersands, quotation marks, and the like.Furthermore, rules that identify demarcating characters can vary incomplexity, such as by considering text representing a value as beingdemarcated by characters that are not a number or word character. A wordcharacters may include a to z, A to Z, or underscore, as an example.Furthermore, text representing a field label could be demarcated in adifferent manner than text representing the value, for at least oneboundary thereof. Additionally, processing, such as decoding, couldoptionally be applied to the text portions to generate the field labeland/or value.

Using such an extraction rule that identifies field labels and valuesusing one or more demarcating characters, a system can identify withintext in a data item that reads “itemid=EST-14,” “itemid” as a fieldlabel, and “EST-14” as a value for a data item associated with the fieldlabel for a field label-data item pair. Such as in the raw event data ofevent 1 in FIG. 8A. Any values that are extracted from events using anextraction rule may be assigned to a new or existing field of an eventas data items, for example, to define a late-binding schema for events.Thus, with reference to FIG. 8A, using the extraction rule, a new eventattribute (an extracted field) may be created and assigned the extractedfield label “itemid” for each event, along with data items correspondingto the extracted value associated with the field label for that event.As an example, the extraction rule may generate itemid data items havingthe values of “EST-14,” “EST-15,” “EST-18” respectively for events 1, 3,and 4 in FIG. 8A. As events 2 and 5 do not include text in the format of“itemid=,” they could optionally be assigned a data item having a blank,or default value, or no value (e.g., empty). Similar extraction rulescan be applied to each search result. The aforementioned exampleutilizes events that are part of search results for convenience only. Itis noted that concepts related to extracting field label-value pairs aremore generally applicable to any set of events.

2.8 Distinguishing Between Extracted Field Label-Value Pairs andExisting Field-Data Item Pairs

In accordance with some implementations of the present disclosure, anextraction rule for extracting field label-value pairs from events canbe used to extract a field label that corresponds to a field labelassigned to another previously extracted field of the events. Thepreviously extracted field may have been extracted using any suitablemeans, such as an extraction rule that only identifies and extractsvalues for a field, or an extraction rule that extracts fieldlabel-value pairs for a field. The values of the extracted fieldlabel-value pairs may be assigned to data items of another field of theevents (e.g., a new field), in addition to or instead of assigning thevalues to data items of the existing field of the events.

Thus, the newly extracted values can be distinguished from thepreviously extracted values. This approach can be useful in manycontexts, such as to distinguish between values that were extracted fromevents using different extraction rules. As another example, thisapproach can be used to distinguish between values that were extractedfrom one event attribute of events (e.g., event raw data), and valuesthat were extracted from another event attribute of the event (e.g., anextracted field).

Referring to FIG. 8G, exemplary events are shown in table format 802including fields extracted from the events. Assume that field 850 havingfield label 852 “itemid” was extracted from event attribute 854 havingattribute label 856 “_raw” (e.g., event raw data) using an extractionrule which may include a regular expression and may extract valuesassociated with instance 872 of “itemid=”. An extraction rule forextracting field label-value pairs from field 858 having field label 860“referer” can be used to extract field label 862 that corresponds tofield label 852 “itemid” of previously extracted field 850 of theevents. In accordance with implementations of the present disclosure,the system may cause values 864 of the extracted field label-value pairsto be assigned as data items of another field of the events (e.g., a newfield 866 having field label 868 “referer_itemid” in FIG. 8G), inaddition to, or instead of assigning values 864 to data items ofexisting field 852 of the events (e.g., automatically).

Where a new field is created, in some cases, the new field could beassigned the field label that was associated with the values (e.g.,field label 862). However, in the example shown, new field 866 isassigned another field label 868, such as a modified version of fieldlabel 862. As examples, the assigned field label could be the identifiedfield label prepended, appended, or otherwise supplemented with text,such as user specified text. Instead of user specified text, the textcould be automatically generated. In the example shown, the text is fromattribute or field label 852 that is assigned to event attribute orfield 858 from which values 864 were extracted (i.e., “referer”). Thus,field label 868 that is assigned to new field 866 identifies the sourceof values 864 for that field.

In accordance with some implementations, the extraction of fieldlabel-value pairs can be invoked using a command. A command identifierfor the command could be “autoextract,” as a specific example. Thecommand could optionally allow the user to specify how to supplement theidentified field label, such as the text for supplementing theidentified field label, for example, using prepend (if any). The commandcould also optionally specify which attribute(s) of the events should beused to identify the field label-value pairs. Furthermore, the commandcould also optionally specify which attribute label(s) of the eventsshould be identified as field labels for the field label-value pairs inthe events. In some cases, the command may identify all fieldlabel-value pairs that exist in the events, or only in specifiedattributes thereof. Where an attribute label is specified, the commandmay optionally only identify field label-value pairs that include theattribute label as a field label. Additionally, the command couldoptionally specify whether to decode the field label and/or value duringextraction. Where decoding is specified, the command may further specifywhich decoding libraries should be utilized for the decoding.

An exemplary command in accordance with the forgoing could be invokedwith “autoextract attribute=‘itemid’ prepend=‘new_’ decode=‘url’.” Inthis example, “autoextract” is a command identifier,“attribute=‘itemid’” instructs the command to extract from the eventattribute having an attribute label of “itemid,” and “prepend=‘new_’”instructs the command to prepend any field labels identified in theitemid attribute with “new_.” Furthermore, decode=‘url’ instructs thecommand to use URL decoding (e.g., by referring to a URL decodinglibrary) on any extracted values.

In executing this exemplary autoextract command, the system may searchthrough the data items associated with the itemid attribute for eventsprovided as input to the command. The autoextract command can employextraction rules to extract sets of field label value pairs for eachfield label and associated values identified in the data items. In thiscase, the field labels may not only be identified in the data items, butalso generated, or extracted from the data items. For example, thecommand may search for text in data items having the format “A=B,” whereeach unique A is made a field label for extraction and each B is a valueassociated with the field label, as one example. Using such a command,at least one field label automatically discovered and extracted from thedata items may match or otherwise correspond to a field label of analready existing extracted field. Despite this, the values associatedwith discovered field labels are assigned to data items of new fields,thereby distinguishing the values from the values of already existingfields. Based on the prepend, the new fields generated by theautoextract command will each be assigned field labels comprising thediscovered field labels prepended with “new_.” Thus, a user may easilyidentify the fields in a graphical interface. The autoextract commandmay optionally correspond to the option labeled “Auto-extract” in FIG.8C.

It will be appreciated that many variations of the forgoing arepossible. In the foregoing example, each field label that is discoveredis automatically prepended with text regardless of whether thediscovered field labels correspond to a field label of an alreadyexisting field. In accordance with some implementations of the presentdisclosure, the system can identify (e.g., automatically) where anextraction rule for extracting field label-value pairs from eventsextracts a field label that corresponds to a field label assigned toanother previously extracted (and assigned) field of the events.

Doing so can provide various benefits. In the autoextract command above,for example, the system could optionally treat discovered field labelsthat do not correspond to a field label of an existing field differentfrom those that do (also referred to as “duplicate field labels” forconvenience). As an example, the system may automatically perform someaction, such as presenting one or more options to the user based on theidentification. As another example, the system could apply the prependedtext (or other modified version of a field label) only to duplicatefield labels (e.g., as part of the command), which may be performedautomatically, or could be one of the above options selectable by theuser. However, it is noted that benefits associated with identifyingduplicate field labels in field label-value pair extraction are notlimited to the autoextract command, and are more generally applicable tofield label-value pair extraction.

2.9 Extracting Field Label-Value Pairs from Extracted Fields

In further respects, the preset disclosure relates to extracting fieldlabel-value pairs from data items of a field (e.g., assigned to one ormore events) that were themselves extracted from an event attribute. Forexample, the data items may have been extracted from event raw data, oranother extracted field. Furthermore, the data items may have beenextracted using any suitable extraction rule. Examples of suitableextraction rules include an extraction rule for extracting fieldlabel-value pairs, and an extraction rule that only providesinstruction(s) for identifying and extracting values from data for afield.

Such an approach provides many potential benefits, an example of whichis described with respect to the events of FIG. 8G, by way of exampleonly. As can be seen in FIG. 8G, some of the event raw data shown inevent attribute 854 of events 1, 3, and 4 includes two instances of“itemid=,” instance 870 embedded in a (uniform resource identifier) URIand instance 872. A user may wish to create a field based on instance870 only, as each instance may have a different meaning. Instead of onecomplicated extraction rule, two simpler extraction rules could beemployed to extract the desired data. First, a regular expression basedextraction rule could be used to extract the URI to new field 858 havingfield label 860 “referer,” as shown in FIG. 8G. Subsequently, fieldlabel-value pair extraction can be performed on extracted field 858, soas to extract values 864 associated with field label 862 “itemid” in theURI, as opposed to anywhere in the raw event data. FIG. 8G showsextracted field 866 having field label 868 “referer_itemid,” which canbe a new field extracted from extracted field 858 having field label 860“referer.”

As another example, the subsequent extraction could be part of a commandto automatically extract any field label-value pairs it discovers indata items of a specified attribute for events, such as in some of theexemplary autoextract commands described above (e.g., using“Auto-Extract” in FIG. 8C). Applying such as command to the event rawdata of event attribute 854 of events 1, 3, and 4 may extract fieldlabel-value pairs for each field label discovered therein, which mayinclude, itemid, JSESSIONID, categoryid, productid, and action, and alsomight automatically assign those field label-value pairs to fields.However, the user may only be interested in itemid. In accordance withimplementations of the present disclosure, the command could be appliedto an extracted field (e.g., field 858), such that the field labels(e.g., field label 862) that are extracted from the extracted fieldcomprise a subset of the field labels that would have been extracted hadthe same command(s) been applied to event attribute 854 (or anotherevent attribute such as a field). Where the events are displayed in atable format, such as table format 802, such a command(s) could beassociated with an option in an option menu where the user selected acolumn corresponding to the extracted field (e.g., field 858). Amongstother possible benefits, this approach can simplify the user experiencewhile avoiding unwanted or unnecessary extractions.

3.0 Suggested Field Label-Value Pair Extractions

In some respects, the present disclosure relates to suggesting fieldlabel-value pair extractions. One or more field label-value pairextractions can be suggested to a user, and may be suggested based onanalyzing one or more portions of one or more events of a set of events.In some cases, the one or more portions that are analyzed are selectedby a user, such as in a user interface displaying at least some of theset of events. One such suitable interface may display a table format,such as table format 802. Furthermore, the selected one or more portionscould correspond to selected portions of the table format, which couldbe accomplished in a similar manner as described above, amongst otherpossibilities.

In some implementations, the system receives data indicating theselection of one or more portions of data items of a set of events in agraphical interface displaying one or more events of the set of events.Based on the selection, the system automatically detects at least onefield label-value pair at least partially within the selected one ormore portions of the data items. Each detected field label-value paircan include a value and an associated field label. For example, thesystem may automatically determine an extraction rule capable ofextracting a field label-value pair at least partially within at leastselected one or more value, thereby detecting the field label-valuepair.

If a user selects a cell in the table interface, which could correspondto the selection of cell 810 shown in FIG. 8B, the system could attemptto detect at least one field label-value pair that is at least partiallywithin the data item corresponding to cell 810. One such fieldlabel-value pair that may be detected in cell 810 has a field label of“productid” and a value of “SF-BVF-G01.”

If a user selects a column in the table interface, which couldcorrespond to the selection of column 804 a shown in FIG. 8C, the systemcould attempt to detect at least one field label-value pair that is atleast partially within the data items corresponding to column 804 a. Asa further example, if a user selects multiple columns in the tableinterface, which could correspond to the selection of columns 804 c and804 e shown in FIG. 8D, the system could attempt to detect at least onefield label-value pair that is at least partially within the data itemscorresponding to columns 804 c and 804 e.

Additionally, if a user selects a portion of a textual representation ofa values of one or more data items in the table interface, which couldcorrespond to the selection of portion 814 of textual representation 812shown in FIG. 8F, the system could attempt to detect at least one fieldlabel-value pair that is at least partially within portion 814. One suchfield label-value pair that may be detected partially within portion 814has a field label of “productid” and a value of “BS-AG-G09.” The usermay select at least a portion of text corresponding to the field label,the value, or both the field label and value. In some cases, the usermay optionally be required to select all of the associated text and notjust the portion.

In further respects, each field label-value pair may be detected basedon determining a corresponding extraction rule. For example, asindicated above, a field label-value pair may be detected based on beingextractable using the corresponding extraction rule. However, in orderto detect the field label-value pair, the field label-value pair doesnot necessarily have to be extracted using the corresponding extractionrule (although it may be). Rather, the system need only detect that afield label-value pair is extractable at least partially within theselection portion using the corresponding extraction rule. A fieldlabel-value pair may be considered at least partially within a selectedportion of a data item for purposed of detection where at least some ofthe textual representation of the data item could be utilized togenerate the value and/or the field label of the field label-value pairusing the corresponding extraction rule.

The corresponding extraction rule could be a predefined extraction rule,a user generated extraction rule, a user specified extraction rule, oran automatically generated extraction rule, as some examples. In somecases the extraction rule may be generated at least partially based onthe selection of the portion of the data items. In these cases, theextraction rule may be automatically generated by the system, or may beautomatically generated and subsequently revised based on user input. Asan example, an extraction rule can comprise one or more regularexpressions that provide instructions for identifying field labelsand/or values from data. As another example, an extraction rule caninclude detecting a first text portion as being separated by one or moredesignated demarcating characters from a second text portion in data.

Further based on the selection of the portion of the data items, thesystem can cause display of one or more options corresponding to one ormore of the detected field label-data item pairs. For example, theoptions could be included in an option menu, which could be one ofoptions 930 a, 930 b, 930 c, or 930 d or option menu 926 of FIG. 9 basedon detection of a field label-value pair at least partially in aselected portion of a table format (e.g., cell(s), column(s), and/orportion(s) of a textual representation(s)). With respect to FIG. 8F, theoption could be option 832 and could read “Extract ‘productid’,” with‘productid’ being contextually generated based on the user selection. Inaddition, or instead, one of the options could read “Autoextract,” andcorrespond to the autoextract command described above.

It is noted that not all detected field-label value pairs may besuggested with the options. Instead, a subset of detected field-labelpairs may be suggested for extraction. Various selection criteria couldbe employed to choose which detected field-label pairs to suggest forextraction. In some cases, the selection criteria may be based on anumber of field label-value pairs that are extractable using thecorresponding extraction rule, with one or more detected fieldlabel-value pairs corresponding to the top numbers being used forsuggestion.

Based on an option of the displayed one or more options being selected,the system can carry out one or more operations associated with theoption. In some cases, the operations comprise one or more data itemsbeing assigned to one or more fields of the set of events (e.g., a newfields and/or existing fields). The one or more data items can beextracted using the corresponding extraction rule(s) for the one or moreof the detected field label-data item pairs that correspond to theoption.

At least one of the one or more data items may optionally comprise avalue extracted and/or displayed before the option was selected, forexample, as part of detecting the at least one field label-value pairs.However, at least one of the one or more data items may optionallycomprise a value extracted based on, or responsive to, the selection ofthe option. For example, as described above, detection of a fieldlabel-value pair does not require extraction by the correspondingextraction rule, but could use some heuristic. Another scenario could bethat the corresponding extraction rule was only partially executed fordetection, for example, until at least one field label-value pair hadbeen extracted. Yet another example is where the option corresponds to acommand that extracts field label-value pairs that are identified withinmore than just the selected portion(s) of the data item(s), such as anentire column, where the user selected a cell or a textualrepresentation of a data item value.

Thus, a user could select the “Extract ‘productid’” option describedabove, and the system could assign only field label-value pairs thatinclude the field label “productid” and any associated extracted valuesto data items of events as a new field that the system assigns the fieldlabel of “productid” (e.g., using a command associated with the selectedoption). The system may further automatically add a column correspondingto the new data items to the table format, or other format utilized todisplay events. As another example, a user could select the“Autoextract” option described above, and similar operations may beperformed as the Extract ‘productid’” option, with additional operationsbeing performed to extract any other field label-value pairs that anautoextract command discovers at least partially in the selectedposition(s) of the data item(s).

It is noted that options that are displayed and correspond to one ormore of the detected field label-data item pairs need not be displayedin an option menu, or in the same option menu as other options whenimplemented with search screen 800. In some cases, one or more optionsmay be displayed in a sidebar, such as sidebar 830, as one example. Asanother example, one or more of options may not be selectable. Forexample, an option could be displayed as non-selectable dialog, and maybe included in a dialog box. The user may select the one or moreportions of the events by hovering over a selectable region thatcorresponds to the one or more portions of the events. If a fieldlabel-value pair is detected, the dialog may be presented to the user.

It is further noted that although suggesting field label-value pairextractions could be integrated into a search interface that correspondsto search screen 800, with the set of events being search resultsdescribed with respect to search screen 800, field label-value pairextractions could be suggested in other contexts, and need to be basedon search results. As an example, the suggestions could be provided aspart of a configuration interface (or search interface), where an optionmay be operable to save the corresponding extraction rule(s) (e.g.,generated based on the user's selection of events) to a configurationfile. In addition, or instead, an option may save the data itemsextracted with the corresponding extraction rule(s) (e.g., to theconfiguration file). The configuration file could be used to apply thesuggested field label-value pair extractions (e.g., the correspondingextraction rule(s)) to other events than were utilized to generate thesuggestions. For example, the configuration file may be loaded for thispurpose in a search interface (e.g., in search screen 800). These andother possibilities are contemplated with respect to suggesting fieldlabel-value pair extractions.

3.1 Log Chat

In some respects, the present disclosure relates to various approachesfor displaying data from events in a visually distinct display format.In various implementations, at least one request is received to displayat least a portion of a first events set and at least a portion of asecond events set (e.g., first time-stamped events set and a secondtime-stamped events set). In response to receiving the at least onerequest, the system can cause for display, on a user interface, the atleast a portion of the first events set and the at least a portion ofthe second events set in the visually distinct display format. Thevisually distinct display format can be utilized to aid in searching andanalysis of event data. For example, because the at least a portion ofthe first events set is displayed in a visually distinct manner from theat least a portion of the second events set, a user can quickly andefficiently identify patterns in the data.

Referring to FIG. 12, an exemplary display of data from events in avisually distinct display format is shown. The visually distinct displayformat may also be a log chat format, an example of which is shown inlog chat screen 1200. In FIG. 12, the at least a portion of the firstevents set can correspond to data portions 1202 a, 1202 b, 1202 c, 1202d, and 1202 e (which are also referred to collectively herein as “dataportions 1202”). Also in FIG. 12, the at least a portion of the secondevents set can correspond to data portions 1204 a, 1204 b, 1204 c, and1204 d (which are also referred to collectively herein as “data portions1204”). Although only data portions 1202 and 1204 are shown, each of theat least a portion of the first and second events sets can compriseadditional data portions, which may be displayed, for example, byscrolling, or otherwise interacting with log chat screen 1200.

Each data portion can correspond to an event in an events set. Forexample, each data portion may represent event raw data of a respectiveevent, as shown. Although data portions are shown with text from eventraw data, the event raw data could be represented in another way, andfurthermore, not all of the event raw data need be shown, or could bemodified and shown. Furthermore, a data portion may represent, orcorrespond to, any event attribute of an event, such as an extractedfield, a default field or metadata field of an event, or any statistics,aggregates, or values calculated from one or more events, and couldcomprise a value of the event attribute for its corresponding event.

Thus, for example, either one of the at least a portion of the firstevents set and the at least a portion of the second events set cancomprise statistics, aggregates, or calculations based on an event or avalue in the event.

Data portions 1202 and data portions 1204 are visually distinguishablefrom one another. For example, data portions 1202 are each formatted inaccordance with a first presentation format and data portions 1204 areeach formatted in accordance with a second presentation format. In somerespects, the causing display, on the user interface, of the at least aportion of the first events set and of the at least a portion of thesecond events set in the visually distinct display format can includecausing display, on the user interface, of the at least a portion of thefirst events set in a first color, and causing display, on the userinterface, of the at least a portion of the second events set in asecond color that is different from the first color.

In the present example, each data portion of data portions 1202 and 1204may be contained within a respective box, as shown. Boxes for dataportions 1202 can be shaded with one color and boxes for data portions1204 with another to visually distinguish the data portions. In theexample shown, boxes for data portions 1202 are bolded so as todistinguish them from boxes for data portions 1204. Furthermore, thefirst presentation is distinguished from the second presentation formatin that each have a different alignment for the data portions. Inparticular, boxes for data portions 1202 are aligned with one side oflog chat screen 1200 (e.g., in a left-aligned format) and boxes for dataportions 1204 are aligned with the other side of log chat screen 1200(e.g., in a right-aligned format).

Further shown in FIG. 12, the visually distinct display format is aninterleaved and visually distinct display format, where, data from theat least a portion of the first events set is interleaved with data fromthe at least a portion of the second events set. As shown, data portions1202 are interleaved with data portions 1204 such that the data portionsare displayed in an alternating arrangement. The data from the at leasta portion of the first events set and the data from the at least aportion of the second events set can be presented in chronological orderbased on timestamps, using the interleaving. For example, as shown, eachdata portion represents a respective event, and is positioned based on atime-stamp (e.g., _time field value) assigned to the event.

A source for the at least a portion of the first events set represents afirst participant in the visually distinct display format, and a sourcefor the at least a portion of the second events set represents a secondparticipant in the visually distinct display format. In the exampleshown, the source of data portions 1202 is visually indicated as being“web logs” 1201, and the source of data portions 1204 is visuallyindicated as being “MySQL Logs” 1203. The visual indications may eachoptionally include a respective checkbox that can be used to selectivelyenable or disable display of corresponding data portions (not shown).For example, a checkbox for Web Logs can be used to remove data portions1202 from the visualization, or otherwise minimize or alter theirpresentation. The checkbox may be selected again to restore the originalpresentation. Additionally, the visual indications may each optionallyinclude a legend element, as shown which is formatted similar to theboxes for the data portions to indicate which data portions areassociated with which source.

In some implementations, the sources can correspond to different searchresult sets, which may be provided from different search queries. Forexample, the source web logs 1201 could correspond to an output data setof the saved pipeline “Web Logs” in FIG. 11 and the source MySQL Logs1203 could correspond to an output data set of the saved pipeline “MySQLLogs” in FIG. 11. However, it is noted that the pipelines need not besaved to be a source. As an example, one or both of web logs 1201 andMySQL Logs 1203 could be loaded in respective interfaces (e.g.,windows), which may be respectively accessible using tabs 1206 a and1206 b. The interfaces may be an interface described above, such assearch interfaces, or other interfaces. The log chat interface shown maycorrespond to tab 1206 c in FIG. 12 and a user may select the tabs totraverse between interfaces.

Thus, in some respects, a first request can be received to represent theat least a portion of the first time-stamped events set as a first tabon the user interface (e.g., to load the source in tab 1206 a) and asecond request is received to represent the at least a portion of thesecond time-stamped events set as a second tab on the user interface(e.g., to load the source in tab 1206 b). Furthermore, a request may bereceived to join data represented by the first and second tabs in thevisually distinct display format. For example, a user may initiate arequest to join data represented by tabs 1206 a and 1206 b as dataportions 1202 and 1204 in the visually distinct display format.

It is further noted that in some implementations, multiple sources canbe provided by the same pipeline, or search query. As an example, thetwo sources might be from the same output data set of the saved pipeline“MySQL Logs” in FIG. 11. As an example, one source could be assigned aseach event in an output data set that has a data item of a particularfield with a first value and another source could be assigned as eachevent in the output data set that has a data item of the particularfield with a second value. As another example, each source maycorrespond to a different field within the same output data set. As afurther example, one source could correspond to a particular field orother value assigned to events from an output data set and anothersource could correspond to event raw data of the events of the outputdata set. It is further noted that, a single source could be provided bymultiple pipelines, or search queries. As an example, the sources mightbe from a mixing of output data sets provided by the saved pipelines“MySQL Logs” and “Web Logs” in FIG. 11, or loaded in a tab.

In some cases, the at least a portion of the first events set comprisesthe first events set, and the at least a portion of the second eventsset comprises the second events set. For example, the first events setcould correspond an output data set from one pipeline (e.g., the savedpipeline “Web Logs” in FIG. 11), and the second events set couldcorrespond to an output data set from another pipeline (e.g., the savedpipeline “MySQL Logs” in FIG. 11). In other cases, subsets of the outputdata sets can be employed.

The first events set can represent data from a first system (e.g., rawlog data), and the second events set can represents data from a secondsystem (e.g., raw log data). For example, the first events set may onlycomprise data corresponding to events from a first system and the secondevents set may only comprise data corresponding to events from a secondsystem. This may be achieved, for example, by filtering out events fromother systems in a pipeline used to provide the data. As an example, thefirst events set may have been provided by filtering out events that donot have a particular first host field value and, the second events setmay have been provided by filtering out events that do not have aparticular second host field value. As another example, each sourcecould be assigned as a different value of a host field from the sameoutput data set. It should be appreciated that fields other than thehost field can be utilized in the forgoing examples, such as otherdefault fields (e.g., a source type field, or a source field), orextracted fields.

The at least a portion of the first events set can represent a column ofdata from a first data table, and the at least a portion of the secondevents set can represent a column of data from a second data table. Forexample, where the source representing the first participant is loadedinto a table format, for example, in a search screen such as searchscreen 800 (e.g., in tab 1206 a), data portions 1202 may be providedfrom an event attribute that corresponds to a column in the table format(e.g., values of data items in the column). Similarly, where the sourcerepresenting the second participant is loaded into a table format, forexample, in a search screen such as search screen 800 (e.g. in tab 1206b), data portions 1204 may be provided from an event attribute thatcorresponds to a column in the table format (e.g., values of data itemsin the column).

As another example, the at least a portion of the first events set canrepresent a column of data from a first data table, and the at least aportion of the second events set can represent another column of datafrom the first data table. For example, in the example above, the sourcerepresenting the second participant may instead be loaded into the tableformat as the source representing the first participant, and dataportions 1204 may be provided from an event attribute that correspondsto a column in the table format (e.g., values of data items in thecolumn).

Regardless of whether sources correspond to the same or different searchqueries and/or data processing pipelines, any source may be configuredsuch that its data portions correspond to any single event attribute ofthe events, such as an extracted field, a default field or metadatafield of an event, or any statistics, aggregates, or values calculatedfrom one or more events, combinations thereof, or multiple eventattributes thereof. For example, one source could comprise event rawdata with each data portion comprising event raw data for a respectiveevent. Another source could comprise a field extracted from event rawdata with each data portion comprising values of the field for arespective event. As a further example, a source could comprise multipleevent attributes of events with each data portion comprising values ofeach of the event attributes or combinations or derivations thereof.

Furthermore, the source for any given participant in the visuallydistinct display format could optionally change to another source, suchas any source described herein based on one or more conditions beingmet. One such condition could be time, which may be calculated from thevalues of time-stamps of events corresponding to the source. After thetime between data portions exceeds a threshold value, or when atimestamp associated with an event corresponding to a data portionexceeds a threshold value, the source might change (e.g., to a differentevent attribute, such as a different field extracted from the events, ora different data processing pipeline, or both a different eventattribute and a different data processing pipeline). In addition to, orinstead of time, other values associated with event attributes may beconsidered. More particularly, while time-stamp values of one or moreevents might be compared to the threshold value as in the examplesabove, other values of one or more other event attributes may becompared to a respective threshold value, such as values of extractedfields, or statistical or calculated values derived from the events. Inaddition to, or instead of changing to another source, in any of theforegoing situations, the presentation format of data portionsassociated with that participant may change based on one or more valuesexceeding one or more threshold values. Any aspect of the presentationformat may change, such as the color, boxes, font size, or formatting.

It is further noted that the visually distinct display format need notbe limited to two participants. For example, in some cases, a request isreceived to display the at least a portion of the first events set, theat least a portion of the second events set, and at least a portion of athird events set (e.g., a time-stamped events set) in the visuallydistinct display format. The system causes display, on the userinterface, the at least a portion of the first events set, the at leasta portion of the second events set, and the at least a portion of thethird events set in the visually distinct display format (e.g., aninterleaved and visually distinct display format). A source for the atleast a portion of the third events set can represent a thirdparticipant in the visually distinct display format. Thus, data portionscan be provided from the source that are interleaved with data portions1202 and 1204 and may be represented using a different color (or otherpresentation format) than either of data portions 1202 and 1204 (e.g.,with different colored boxes).

3.2 Additional Exemplary Implementations

FIG. 13 presents a flowchart illustrating cell-based table manipulationin accordance with the disclosed embodiments. Each block illustratingmethods in accordance with FIG. 13, and other methods described herein,comprises a computing process that may be performed using anycombination of hardware, firmware, and/or software. For instance,various functions may be carried out by a processor executinginstructions stored in memory. The methods may also be embodied ascomputer-usable instructions stored on computer storage media. Themethods may be provided by a standalone application, a service or hostedservice (standalone or in combination with another hosted service), or aplug-in to another product, to name a few.

At block 1302, display is caused of a search interface in a tableformat. For example, a search system can cause display of a searchinterface in a table format (e.g., table format 802) that includes oneor more columns (e.g., one or more of columns 804 a, 804 b, 804 c, 804d, 804 e, 804 f, 804 g, and 804 h), each column comprising data items ofan event attribute, the data items being of a set of events, and aplurality of rows forming cells with the one or more columns (e.g., anycombination of rows 806 a, 806 b, 806 c, 806 d, and 806 e), each cellcomprising one or more of the data items of the event attribute of acorresponding column, and each cell being selectable by a user (e.g.,any of the cells shown in table format 802).

At block 1304, display is caused on of a list of corresponding to aselected cell(s). For example, based on the user selecting one or moreof the cells (e.g., cell 810 in FIG. 8B) in the table format, displaycan be caused of a list of options (e.g., option menu 826 a in FIG. 8B)corresponding to the selected one or more cells.

At block 1306, a command(s) is added to a search query that correspondsto a set of events (e.g., a search results set produced by the searchquery, or based on the search query). For example, one or more commandsmay be caused to be added to a search query that corresponds to the setof events, the one or more commands being based on at least an optionthat is selected from the list of options and the event attribute foreach of the one or more of the data items of each of the selected one ormore cells.

In some cases, the selected option is caused to be included in thedisplayed list of options based on a determination that at least one ofthe selected one or more cells is an empty cell. In some cases, theselected option is caused to be included in the displayed list ofoptions based on a determination that at least one of the one or more ofthe data items of at least one of the selected one or more cells is of anumeric data type. In some cases, the selected option is caused to beincluded in the displayed list of options based on a determination thatat least one of the one or more of the data items of at least one of theselected one or more cells is of a categorical data type. In some cases,the selected option is caused to be included in the displayed list ofoptions based on a determination that at least one of the one or more ofthe data items of at least one of the selected one or more cellscomprises event raw data. In some cases, the selected option is causedto be included in the displayed list of options based on a determinationthat at least one of the one or more of the data items of at least oneof the selected one or more cells comprises a timestamp (e.g., of eventraw data). In some cases, the selected one or more cells comprise afirst selected cell and a second selected cell, and the selected optionis caused to be included in the displayed list of options based on adetermination that the first and second cells are in different columnsof the one or more columns. In some cases, the selected option is causedto be included in the displayed list of options based on a determinationthat at least one of the one or more of the data items of at least oneof the selected one or more cells comprise a statistical value generatedby one or more statistical functions performed on values of data itemsof at least some of the set of events. In some cases, the selectedoption is caused to be included in the displayed list of options basedon a determination that at least one of the one or more of the dataitems of at least one of the selected one or more cells comprisesmultiple values. In some cases, the selected option is caused to beincluded in the displayed list of options based on detection of at leastone field-label value pair in the selected one or more cells.

In some cases, the data items of the event attribute of thecorresponding column of at least one of the selected one or more cellseach comprise values extracted from the set of events using a commonextraction rule.

In some cases, the selected one or more cells is an individuallyselected cell. In some cases, the selected option is caused to begenerated at least partially based on detection of at least one fieldlabel-value pair in the selected one or more cells.

In some cases, a field label of a field-label value pair is caused to bedetected in the selected one or more cells, and the field label iscaused to be displayed in an option in the displayed list of options.

In some cases, one or more command elements of the one or more commandsentered into a form by the user are received, the option is displayed inthe list of options as the form.

In some cases, one or more command elements of the one or more commandsinclude at least one value of the one or more of the data items for eachof the selected one or more cells.

In some cases, further based on the user selecting the one or more ofthe cells in the table format, the event attribute for each of the oneor more of the data items of each of the selected one or more cells iscaused to be included as one or more command elements of the one or morecommands.

In some cases, further based on the user selecting the one or more ofthe cells in the table format, the search query comprising the one ormore commands is caused to be automatically executed, the set of eventsis caused to be updated to correspond to the executed search query, andthe displayed search interface is caused to be updated to correspond tothe updated set of events.

In some cases, further based on the user selecting the one or more ofthe cells in the table format, a displayed representation of the searchquery in the user interface is caused to be automatically updated toinclude a representation of the added one or more commands.

In some cases, further based on the user selecting the one or more ofthe cells in the table format, the search query comprising the added oneor more commands is caused to be executed, the executing applying a latebinding schema to events, the late binding schema associated with one ormore extraction rules defining one or more fields for the set of events.

In some cases, the one or more commands are operable by the searchsystem to extract one or more field label-values pairs from at least thedata items of each of the selected one or more cells and assign thefield label-value pairs to at least one event of the set of events.

In some cases, display is caused of the option as a form in thedisplayed list of options, the form comprising at least one form elementoperable to enter one or more command elements into the one or morecommands, and further based on the user selecting the one or more of thecells in the table format, the form is caused to be automaticallyreproduced in the search interface, the reproduced form being operableby the user to modify the one or more commands added in the searchquery.

In some cases, further based on the user selecting the one or more ofthe cells in the table format, a command entry that represents the oneor more commands is caused to be automatically added to a displayed listof command entries in the search interface, each of the command entriesrespectively representing one or more commands of a plurality ofcommands of the search query, the list of command entries beingdisplayed in a sequence corresponding to the plurality of commands ofthe search query.

In some cases, the one or more commands are of a pipelined searchlanguage.

In some cases, the search query comprises an input search query and anadditional search query that extends the input search query, the searchinterface restricting the user from modifying the input search query.

FIG. 14 presents a flowchart illustrating column-based tablemanipulation in accordance with the disclosed embodiments. At block1402, display is caused on a search interface in a table format. Forexample, display can be caused of a search interface in a table format(e.g., table format 802) that includes a plurality of columns (e.g., anycombination of columns 804 a, 804 b, 804 c, 804 d, 804 e, 804 f, 804 g,and 804 h), each column comprising data items of an event attribute, thedata items being of a set of events, each column being selectable by auser, and a plurality of rows (e.g., any combination of rows 806 a, 806b, 806 c, 806 d, and 806 e) forming cells with the one or more columns,each cell comprising one or more of the data items of the eventattribute of a corresponding column.

At block 1404, display is caused on of a list of corresponding to aselected column(s). For example, based on the user selecting one or moreof the columns (e.g., column 804 a in FIG. 8C or Columns 804 c and 804 ein FIG. 8D) of the plurality of columns in the table format, display canbe cause of a list of options (e.g., option menu 826 b in FIG. 8C oroption menu 826 c in FIG. 8D) corresponding to the selected one or morecolumns.

At block 1406, a command(s) are caused to be added to a search querythat corresponds to a set of events (e.g., a search results set producedby the search query, or based on the search query). For example, one ormore commands can be caused to be added to a search query thatcorresponds to the set of events, the one or more commands being basedon at least an option that is selected from the list of options and theevent attribute of each of the selected one or more columns.

In some cases, the selected option is caused to be included in thedisplayed list of options based on a determination that at least one ofthe cells of at least one of the selected one or more of the columns isan empty cell. In some cases, the selected option is caused to beincluded in the displayed list of options based on a determination thatat least one of the selected one or more of the columns represents dataitems of a numeric data type. In some cases, the selected option iscaused to be included in the displayed list of options based on adetermination that at least one of the selected one or more of thecolumns represents data items of a categorical data type. In some cases,the selected option is caused to be included in the displayed list ofoptions based on a determination that at least one of the selected oneor more of the columns represents event raw data of the set of events.In some cases, the selected option is caused to be included in thedisplayed list of options based on a determination that at least one ofthe selected one or more of the columns represents data items comprisingtimestamps (e.g., of the set of events). In some cases, the selectedoption is caused to be included in the displayed list of options basedon a determination that at least one of the selected one or more of thecolumns represents data items comprising statistical values generated byone or more statistical functions performed on values of data items ofat least some of the set of events. In some cases, the selected optionis caused to be generated at least partially based on detection of atleast one field label-value pair in the selected one or more columns.

In some cases, the columns of the plurality of columns in the tableformat are individually selectable by the user. In some cases, theselected one or more columns is an individually selected column. In somecases, the selected one or more columns comprises at least a firstselected column and a second selected column.

In some cases, the data items of the event attribute of at least one ofthe selected one or more columns comprise values extracted from the setof events using a common extraction rule.

In some cases, a field label of a field-label value pair is caused to bedetected in the selected one or more columns, and the field label iscaused to be displayed in an option in the displayed list of options.

In some cases, one or more command elements of the one or more commandsentered into a form by the user are received, the option is displayed inthe list of options as the form.

In some cases, one or more command elements of the one or more commandsinclude at least one value of the data items for each of the selectedone or more columns.

In some cases, further based on the user selecting the one or more ofthe columns of the plurality of columns in the table format, the eventattribute for each of the data items of each of the selected one or morecolumns is caused to be included as one or more command elements of theone or more commands.

In some cases, further based on the user selecting the one or more ofthe columns of the plurality of columns in the table format, the searchquery comprising the one or more commands is caused to be automaticallyexecuted, the set of events is caused to be updated to correspond to theexecuted search query, and the displayed search interface is caused tobe updated to correspond to the updated set of events.

In some cases, further based on the user selecting the one or more ofthe columns of the plurality of columns in the table format, a displayedrepresentation of the search query in the user interface is caused to beautomatically updated to include a representation of the added one ormore commands.

In some cases, further based on the user selecting the one or more ofthe columns of the plurality of columns in the table format, the searchquery comprising the added one or more commands is caused to beexecuted, the executing applying a late binding schema to events, thelate binding schema associated with one or more extraction rulesdefining one or more fields for the set of events.

In some cases, the one or more commands are operable by the searchsystem to extract one or more field label-values pairs from at least thedata items of each of the selected one or more columns and assign thefield label-value pairs to at least one event of the set of events.

In some cases, display is caused of the option as a form in thedisplayed list of options, the form comprising at least one form elementoperable to enter one or more command elements into the one or morecommands, and further based on the user selecting the one or more of thecolumns of the plurality of columns in the table format, the form iscaused to be automatically reproduced in the search interface, thereproduced form being operable by the user to modify the one or morecommands added in the search query.

In some cases, further based on the user selecting the one or more ofthe columns of the plurality of columns in the table format, a commandentry that represents the one or more commands is caused to beautomatically added to a displayed list of command entries in the searchinterface, each of the command entries respectively representing one ormore commands of a plurality of commands of the search query, the listof command entries being displayed in a sequence corresponding to theplurality of commands of the search query.

In some cases, the one or more commands are of a pipelined searchlanguage.

In some cases, the plurality of columns of the table format is caused tobe reordered in the displayed search interface based on a userinteraction with the table format (e.g., the user dragging a column inthe table format).

In some cases, the selected option is caused to be included in thedisplayed list of options based on a data type assigned to the eventattribute of at least one of the one or more of the data items of atleast one of the selected one or more cells.

FIG. 15 presents a flowchart illustrating text-based table manipulationin accordance with the disclosed embodiments. At block 1502, display iscaused of a search interface in a table format. For example, display canbe caused on a search interface in a table format (e.g., table format802) that include one or more columns (e.g., one or more of columns 804a, 804 b, 804 c, 804 d, 804 e, 804 f, 804 g, and 804 h), each columncomprising data items of an event attribute, the data items being of aset of events, and a plurality of rows forming cells with the one ormore columns (e.g., any combination of rows 806 a, 806 b, 806 c, 806 d,and 806 e), each cell displaying a textual representation of at leastone of the data items of the event attribute of a corresponding column(e.g., textual representation 812 in FIG. 8F), the textualrepresentation being selectable by a user.

At block 1504, display is caused of a list of options corresponding to aselected portion(s) of a textual representation(s) in a correspondingcell(s). For example, based on the user selecting a portion of thetextual representation in a corresponding cell (e.g., portion 514 oftextual representation 512 in FIG. 8F) display can be caused of a listof options (e.g., option menu 826 e in FIG. 8F) corresponding to theselected portion of the textual representation in the correspondingcell.

As block 1506, a command(s) is caused to be added to a search query thatcorresponds to a set of events. For example, one or more commands can becaused to be added to a search query that corresponds to the set ofevents (e.g., a search results set produced by the search query, orbased on the search query), the one or more commands being based on atleast an option that is selected from the list of options and theselected portion of the textual representation in the correspondingcell.

In some cases, the selected option is caused to be included in thedisplayed list of options based on a determination that the selectedportion of the textual representation represents a data item havingmultiple values. In some cases, the selected option is caused to beincluded in the displayed list of options based on a determination thatthe selected portion of the textual representation represents a dataitem comprising event raw data. In some cases, the selected option iscaused to be included in the displayed list of options based on adetermination that the selected portion of the textual representationrepresents a data item of a categorical data type. In some cases, theselected option is caused to be included in the displayed list ofoptions based on detection of at least one field-label value pair in thecorresponding cell.

In some cases, the data items of the event attribute of thecorresponding column of the corresponding cell each comprise valuesextracted from the set of events using a common extraction rule.

In some cases, further based on the user selecting the portion of thetextual representation in the corresponding cell, a field label-valuepair is caused to be detected in at least the selected portion of thetextual representation, where one or more options in the list of optionsare based on the detecting of the field label-value pair.

In some cases, one or more options in the list of options are based onan identification of the selected portion of the textual representationcomprising at least some of a field label of a field label-value pair.

In some cases, the textual representation is of a single data item.

In some cases, a field label of a field-label value pair is caused to bedetected in at least some of the selected portion of the textualrepresentation, and the field label is caused to be displayed in anoption in the displayed list of options.

In some cases, one or more command elements of the one or more commandsentered into a form by the user are received, the option is displayed inthe list of options as the form.

In some cases, the one or more commands are further based on the eventattribute for each of the at least one data items corresponding to thetextual representation comprising the selected portion of the textualrepresentation.

In some cases, one or more command elements of the one or more commandsinclude at least the selected portion of the textual representation.

In some cases, further based on the user selecting the portion of thetextual representation in the corresponding cell, the event attributefor each of the at least one of the data items corresponding to thetextual representation comprising the selected portion of the textualrepresentation is caused to be included as one or more command elementsof the one or more commands.

In some cases, based on the user selecting the portion of the textualrepresentation in the corresponding cell, the search query comprisingthe one or more commands is caused to be automatically executed, the setof events is caused to be updated to correspond to the executed searchquery, and the displayed search interface is caused to be updated tocorrespond to the updated set of events.

In some cases, based on the user selecting the portion of the textualrepresentation in the corresponding cell, a displayed representation ofthe search query in the user interface is caused to be automaticallyupdated to include a representation of the added one or more commands.

In some cases, based on the user selecting the portion of the textualrepresentation in the corresponding cell, the search query comprisingthe added one or more commands is caused to be executed, the executingapplying a late binding schema to events, the late binding schemaassociated with one or more extraction rules defining one or more fieldsfor the set of events.

In some cases, the one or more commands are operable by the searchsystem to extract one or more field label-values pairs from at least thecorresponding cell and assign the field label-value pairs to at leastone event of the set of events.

In some cases, display is caused of the option as a form in thedisplayed list of options, the form comprising at least one form elementoperable to enter one or more command elements into the one or morecommands, and further based on the user selecting the portion of thetextual representation in the corresponding cell, the form is caused tobe automatically reproduced in the search interface, the reproduced formbeing operable by the user to modify the one or more commands added inthe search query.

In some cases, based on the user selecting a portion of the textualrepresentation in a corresponding cell, a command entry that representsthe one or more commands is caused to be automatically added to adisplayed list of command entries in the search interface, each of thecommand entries respectively representing one or more commands of aplurality of commands of the search query, the list of command entriesbeing displayed in a sequence corresponding to the plurality of commandsof the search query.

In some cases, the one or more commands are of a pipelined searchlanguage.

FIG. 16 presents a flowchart illustrating command entry list interactionin accordance with the disclosed embodiments. At block 1602, display iscaused of a list of command entries in a search interface. For example,display is caused of a list of command entries (e.g., command entries1040 b, 1040 c, and 1040 d in FIG. 10) in a search interface, each ofthe command entries representing one or more commands of a plurality ofcommands (e.g., commands 1044 b, 1044 c, and 1044 d) of a search query(e.g., search query 1044), the list of command entries being displayedin a sequence corresponding to the plurality of commands of the searchquery.

As block 1604, modification is caused to the displayed list of commandentries with respect to a designated command entry. For example, basedon a user interaction (e.g., selecting an option associated a commandentry, dragging the command entry to another place in the list toreorder the command entry) with a designated command entry in thedisplayed list of command entries, modification is caused to thedisplayed list of command entries with respect to the designatedcommand.

At block 1606, modification is automatically caused to the search querywith respect to a corresponding command(s) represented by the designatedcommand entry. For example, an automatic modification is caused to thesearch query with respect to the corresponding one or more commandsrepresented by the designated command entry.

In some cases, the modification comprises causing the designated commandentry to be removed from the displayed list of command entries and theautomatic modification comprises causing the corresponding one or morecommands to be removed from the search query. In some cases, themodification comprises causing the designated command entry to bereordered in the displayed list of command entries and the automaticmodification comprises causing the corresponding one or more commands tobe reordered in the search query. In some cases, the modificationcomprises causing the designated command entry to be shifted up in thedisplayed list of command entries and the automatic modificationcomprises causing the corresponding one or more commands to be shiftedup in the search query. In some cases, the modification comprisescausing the designated command entry to be shifted down in the displayedlist of command entries and the automatic modification comprises causingthe corresponding one or more commands to be shifted down in the searchquery.

In some cases, further based on the user interaction with the designatedcommand entry in the displayed list of command entries, a search resultset corresponding to the search query is caused to be automaticallyupdated based on the modified search query.

In some cases, display is caused of a set of events corresponding to thesearch query in the search interface, and further based on the userinteraction with the designated command entry in the displayed list ofcommand entries; the displayed set of events is caused to beautomatically updated to correspond to the modified search query.

In some cases, the designated command entry displays a textualrepresentation of at least portions of the corresponding one or morecommands in a form, the user interaction comprises a user editing thetextual representation using the form, and the automatic modificationcomprises causing at least some of the edited textual representation tobe incorporated into the search query.

In some cases, the designated command entry comprises a textualrepresentation of at least one command identifier of the correspondingone or more commands and a form element representing a command elementof the corresponding one or more commands, and the user interaction iswith the form element.

In some cases, the user interaction comprises a user renaming a commandelement in the corresponding one or more commands using a form elementin the designated command entry that represents the command element, andthe automatic modification comprises causing one or more other commandelements in one or more other commands to be renamed in the search queryso as to correspond to the renamed command element.

In some cases, one or more new commands are caused to be added to themodified search query, and based on the one or more new commands beingadded to the modified search query, a new command entry is caused to beadded to the modified displayed list of command entries, the new commandentry representing the one or more new commands.

In some cases, based on a user selection of a saved data processingpipeline from a plurality of saved data processing pipelines in aselection interface, the search query is caused to be loaded into thesearch interface, where the list of command entries is populated withthe command entries based on the loaded search query, and where theloaded search query defines the saved data processing pipeline.

In some cases, based on a user selection of a saved data processingpipeline from a plurality of saved data processing pipelines in aselection interface, an input search query is caused to be loaded intothe search interface, where the list of command entries is populatedwith an input command entry representing the input search query, wherethe loaded input search query comprises a plurality of commands definingthe saved data processing pipeline, and where the search querycorresponds to an extension of the saved data processing pipeline.

In some cases, based on a user selection of a saved data processingpipeline from a plurality of saved data processing pipelines in aselection interface, the saved data processing pipeline is caused to beloaded into the search interface, and a saved pipeline label assigned tothe saved data processing pipeline is caused to be displayed in thesearch interface, where the search query extends the loaded saved dataprocessing pipeline.

In some cases, display is caused of a plurality of form elements, eachform element having a position corresponding to a respective commandelement of the list of command elements, where the user interactioncomprises a user selection of an option using one of the plurality ofform elements that corresponds to the designated command element.

In some cases, display is caused of a plurality of form elements, eachform element being displayed in association with a respective commandelement of the list of command elements, and each form element isselectable by a user to cause modification to the displayed list ofcommand entries with respect to the respective command element, andcause an automatic modification to the search query with respect to thecorresponding one or more commands represented by the respective commandentry.

FIG. 17 presents a flowchart illustrating enforcing dependency betweensearch queries in accordance with the disclosed embodiments. At block1702, a dependency is created between a first search query and a secondsearch query. For example, a dependency is created between a firstsearch query and a second search query, the first search query defininga first data processing pipeline and the second search query defining asecond data processing pipeline that extends the first data processingpipeline.

At block 1704, a modification is detected to a first data processingpipeline defined by the first search query. For example, a modificationis detected to the first data processing pipeline defined by the firstsearch query.

At block 1706, based on the modification being detected, the dependencyis caused to be enforced, such that a second data processing pipelinesdefined by the second search query is modified to extend the modifiedfirst data processing pipeline. For example, based on the modificationto the first data processing pipeline being detected, the dependency iscaused to be enforced such that the second data processing pipeline ismodified to extend the modified first data processing pipeline.

In some cases, the causing of the dependency to be enforced comprisescausing the second data processing pipeline to be automatically modifiedto extend the modified first data processing pipeline.

In some cases, the first search query comprises a first plurality ofpipelined commands and the second search query comprises a secondplurality of pipelined commands.

In some cases, the modification to the first data processing pipelinecomprises a first set of pipelined commands corresponding to the firstsearch query being modified, and the causing the dependency to beenforced comprises causing a second set of pipelined commandscorresponding to the second search query to be modified to include themodified first set of pipelined commands.

In some cases, further based on the modification to the first dataprocessing pipeline being detected, a dependency is caused to beenforced between the first search query and a third search query, suchthat a third data processing pipeline defined by the third search queryis modified to extend the modified first data processing pipeline, wherethe third search query defines the third data processing pipeline thatextends the first data processing pipeline.

In some cases, the causing the dependency to be enforced comprisescausing a data set to be applied as an input to a portion of the secondsearch query that is extending the first data processing pipeline.

In some cases, display is caused of a selection interface that isoperable by a user to select the first search query from a plurality ofsaved search queries, the first search query and the second search querybeing of the plurality of saved search queries. Based on the userselecting the first search query using the selection interface, displayis caused of at least some commands of the first search query in agraphical interface that is operable by the user to modify the firstsearch query, where the detected modification to the first dataprocessing pipeline defined by the first search query is caused by theuser modifying the first search query using the graphical interface.

In some cases, display is caused of a selection interface that isoperable by a user to select the first search query from a plurality ofsaved search queries, the first search query being of the plurality ofsaved search queries. Based on the user selecting the first search queryusing the selection interface, display is caused of an interface that isoperable by the user to extend the first data processing pipeline byextending the first search query with an additional search query, andthe extended search query is caused to be saved as the second searchquery that extends the first data processing pipeline.

In some cases, display is caused of a selection interface that isoperable by a user to select the first search query from a plurality ofsaved search queries, the first search query being of the plurality ofsaved search queries, and the dependency between the first search queryand the second search query is caused to be created based on the userselecting the first search query from the plurality of saved searchqueries.

In some cases, the detected modification to the first data processingpipeline causes a modification to an output data set corresponding tothe first data processing pipeline, an, the causing of the dependency tobe enforced comprises causing the modified output data set to be appliedas an input to a portion of the second search query that is extendingthe first data processing pipeline.

In some cases, the detected modification to the first data processingpipeline generates an output data set from the modified first dateprocessing pipeline, and the causing the dependency to be enforcedcomprises causing the output data set to be applied as an input to aportion of the second search query that is extending the first dataprocessing pipeline.

In some cases, the causing the dependency to be enforced comprisescausing the second search query to be modified to define the modifiedsecond data processing pipeline.

In some cases, the first search query is caused to be executed, theexecuting applying a late binding schema to events, the late bindingschema associated with one or more extraction rules defining one or morefields for a set of events.

In some cases, the modification to the first data processing pipelinedefined by the first search query comprises a modification to the firstsearch query.

In some cases, the second data processing pipeline is modified to extendthe modified first data processing pipeline while loaded into a searchinterface displaying an output data set of the second data processingpipeline, and further based on the modification to the first dataprocessing pipeline being detected, display is automatically caused of anew output data set corresponding to the modified second data processingpipeline in the search interface.

In some cases, the first search query is caused to be executed togenerate an output data set, and the output data set is caused to bedisplayed in a search interface, the output data set comprising aplurality of time-stamped events, each of the plurality of time-stampedevents comprising event raw data.

In some cases, the second search query is caused to be executed togenerate an output data set, and the output data set is caused to bedisplayed in a search interface, the output data set comprising aplurality of time-stamped events, each of the plurality of time-stampedevents comprising event raw data.

FIG. 18 presents a flowchart illustrating distinguishing field labelsfrom multiple extractions in accordance with the disclosed embodiments.At block 1802, a first value(s) is extracted from a plurality of eventsusing a first extraction rule. For example, first one or more values areextracted from a plurality of events using a first extraction rule. Atblock 1804, the extracted first value(s) is assigned to a first field ofthe plurality of events as a first set of field-data items pairs. Forexample, the extracted first one or more values are assigned to a firstfield of the plurality of events as a first set of field-data itempairs. At block 1806, a field label is assigned to the first field. Atblock 1808, a second value(s) and a field label corresponding to theextracted second value(s) are extracted using a second extraction rule,where the field label corresponds to the field label of the first field.For example, second one or more values and a field label correspondingto the second one or more values are extracted from the plurality of theevents using a second extraction rule, the extracted field labelcorresponding to the assigned field label of the first field. At block1810, the extracted second values are assigned to a second field as asecond set of field-data items pairs. For example, the extracted secondone or more values are assigned to a second field of the plurality ofevents as a second set of field-data item pairs, thereby distinguishingthe extracted second one or more values from the extracted first one ormore values.

In some cases, the using the second extraction rule identifies a valueof the second one or more values for each text portion in a set of dataitems of the plurality of events discovered as being separated by one ormore designated demarcating characters from another text portion thatmatches the field label, the discovered text portion being used as thevalue. In some cases, the using the second extraction rule is part of acommand that automatically extracts all identified field label-valuepairs in a set of data items of the plurality of events, each fieldlabel-value pair comprising a field label and a value, where one of thefield label-value pairs is identified for each first text portionseparated by one or more designated demarcating characters from a secondtext portion in the set of data items, the first text portion matchingthe field label and the second text portion being used as the value.

In some cases, the using the second extraction rule is part of a commandthat automatically extracts all identified field label-value pairswithin a set of data items specified by a command element of thecommand, where each pair of text portions separated by one or moredesignated demarcating characters in the set of data items is identifiedas one of the field label-value pairs.

In some cases, the first extraction rule comprises instructions definingidentification and extraction of a value for a data item of a field anda field label corresponding to the value from data.

In some cases, the second extraction rule generates the second one ormore values and the field label corresponding to the second one or morevalues from the first one or more values of the first set of field-dataitem pairs.

In some cases, it is identified by the system that the extracted fieldlabel corresponds to the assigned field label of the first field, andthe extracted second one or more values are assigned to the second fieldas the second set of field-data item pairs based on the extracted fieldlabel corresponding to the assigned field label of the first field.

In some cases, it is identified by the system that the extracted fieldlabel corresponds to the assigned field label of the first field, andone or more options are caused to be presented to the user based on theidentified correspondence, at least one of the options being selectableby the user to cause the assigning of the extracted second one or morevalues to the second field as the second set of field-data item pairs.

In some cases, a different field label than the extracted field labelcorresponding to the second one or more values is assigned to the secondfield. In some cases, a modified version of the extracted field labelcorresponding to the second one or more values is assigned to the secondfield. In some cases, a modified version of the extracted field labelcorresponding to the second one or more values is assigned to the secondfield, the modified version being the extracted field label prependedwith text (e.g., with text from an a field label assigned to an eventattribute from which the second one or more values were extracted from).

In some cases, the using the second extraction rule generates the secondone or more values and the field label from event raw data of theplurality of events.

In some cases, a late binding schema is applied to the plurality ofevents, the late binding schema being defined by at least the first andsecond extraction rules.

In some cases, the extracting the first one or more values from theplurality of events using the first extraction rule is performed as partof a first command of a search query being executed by a search systemand the extracting the second one or more values and the field labelcorresponding to the second one or more values from the plurality of theevents using the second extraction rule is performed as part of a secondcommand of the search query being executed by the search system.

In some cases, the extracted field label corresponding to the second oneor more values is modified to include at least a portion of text of afield label assigned to an event attribute that the second one or morevalues were extracted from, and the modified version of the extractedfield label is assigned to the second field.

FIG. 19 presents a flowchart illustrating extracting from extractedevent fields in accordance with the disclosed embodiments. At block1902, a first value(s) is extracted from a plurality of events using afirst extraction rule. For example, first one or more values areextracted from a plurality of events using a first extraction rule. Atblock 1904, the extracted first value(s) is assigned to a first field asa first set of field-data items pairs. For example, the extracted firstone or more values are assigned to a first field of the plurality ofevents as a first set of field-data item pairs. At block 1906, a secondvalue(s) is extracted using a second extraction rule that identifies thesecond value(s) and a corresponding field label in the extracted firstvalue(s). For example, second one or more values are extracted from theplurality of the events using a second extraction rule, the secondextraction rule identifying the second one or more values and a fieldlabel corresponding to the second one or more values in the extractedfirst one or more values of the first set of field-data item pairs. Atblock 1908, the extracted second value(s) is assigned to a second fieldas a second set of field-data items pairs. For example, the extractedsecond one or more values are assigned to a second field of theplurality of events as a second set of field-data item pairs.

In some cases, the using the second extraction rule identifies a valueof the second one or more values for each text portion in the extractedfirst one or more values of the first set of field-data item pairsdiscovered as being separated by one or more designated demarcatingcharacters from another text portion that matches the field label, thediscovered text portion being used as the value.

In some cases, the using the second extraction rule is part of a commandthat automatically extracts all identified field label-value pairs inthe extracted first one or more values of the first set of field-dataitem pairs, each field label-value pair comprising a field label and avalue, where one of the field label-value pairs is identified for eachfirst text portion separated by one or more designated demarcatingcharacters from a second text portion in the extracted first one or morevalues of the first set of field-data item pairs, the first text portionmatching the field label and the second text portion being used as thevalue.

In some cases, the using the second extraction rule is part of a commandthat automatically extracts all identified field label-value pairswithin the extracted first one or more values of the first set offield-data item pairs as specified by reference to the first field inthe command, where each pair of text portions separated by one or moredesignated demarcating characters in the extracted first one or morevalues of the first set of field-data item pairs is identified as one ofthe field label-value pairs.

In some cases, the first extraction rule comprises instructions definingidentification and extraction of a data item of a field and a fieldlabel corresponding to the data item from data.

In some cases, the first extraction rule generates the first one or morevalues from event raw data of the plurality of the events.

In some cases, the extracting the first one or more values from theplurality of events using the first extraction rule generates the firstone or more values from one or more data items assigned to a third fieldof the plurality of events as a third set of field-data item pairs.

In some cases, execution of a search query is causes, where theextracting the second one or more values from the plurality of theevents using the second extraction rule is executed as part of a commandof the search query, and display is caused of at least some of theplurality of the events in a search interface with at least some of thesecond one or more values of the second set of field-data item pairs.

In some cases, the using the second extraction rule is part of a commandthat automatically extracts all identified field label-value pairs inthe extracted first one or more values of the first set of field-dataitem pairs, each field label-value pair comprising a field label and avalue, where one of the field label-value pairs is identified for eachfirst text portion separated by one or more designated demarcatingcharacters from a second text portion in the extracted first one or morevalues of the first set of field-data item pairs, the first text portionmatching the field label and the second text portion being used as thevalue, and a new field is caused to be assigned to the plurality ofevents for each unique field label of a plurality of unique field labelsin the identified field label-value pairs, each new field being assigneda modified version of a respective one of the plurality of unique fieldlabels.

In some cases, the field label extracted using the second extractionrule is assigned to the second field. In some cases, a different fieldlabel than the field label extracted using the second extraction rule isassigned to the second field. In some cases, a modified version of thefield label extracted using the second extraction rule is assigned tothe second field. In some cases, the field label extracted using thesecond extraction rule is assigned to the second field as supplementedwith text of a field label assigned to the first field.

In some cases, the using the first extraction rule generates the firstone or more values from event raw data of the plurality of events.

In some cases, a late binding schema is applied to the plurality ofevents, the late binding schema being defined by at least the first andsecond extraction rules.

In some cases, the extracting the first one or more values from theplurality of events using the first extraction rule is performed as partof a first command of a search query being executed by a search systemand the extracting the second one or more values from the plurality ofthe events using the second extraction rule is performed as part of asecond command of the search query being executed by the search system.

FIG. 20 presents a flowchart illustrating displaying at least portionsof first and second events sets in a visually distinct display format inaccordance with the disclosed embodiments. At block 2002, a request isreceived to display at least portions of first and second events sets ina visually distinct display format. For example, a request is receivedto display at least a portion of a first time-stamped events set and atleast a portion of a second time-stamped events set in an interleavedand visually distinct display format, where, in the interleaved andvisually distinct display format, the at least a portion of the firsttime-stamped events set is displayed in a visually distinct manner fromthe at least a portion of the second time-stamped events set, andfurther where, in the interleaved and visually distinct display format,data from the at least a portion of the first time-stamped events set isinterleaved with data from the at least a portion of the secondtime-stamped events set.

At block 2004, in response to receiving the request, display is causedof the at least portions of the first and second events sets in thevisually distinct display format. For example, in response to receivingthe request, display is caused, on a user interface, of the at least aportion of the first time-stamped events set and the at least a portionof the second time-stamped events set in the interleaved and visuallydistinct display format, where a source for the at least a portion ofthe first time-stamped events set represents a first participant in theinterleaved and visually distinct display format, and further where asource for the at least a portion of the second time-stamped events setrepresents a second participant in the interleaved and visually distinctdisplay format, further where the first time-stamped events set and thesecond time-stamped events set are extracted by executing a searchquery, and where the executing the search query comprises applying alate binding schema to source data, the late binding schema associatedwith one or more extraction rules defining one or more fields.

In some cases, the causing display, on the user interface, of the atleast a portion of the first time-stamped events set and of the at leasta portion of the second time-stamped events set in the interleaved andvisually distinct display format comprises causing display, on the userinterface, of the at least a portion of the first time-stamped eventsset in a first color, and causing display, on the user interface, of theat least a portion of the second time-stamped events set in a secondcolor, where the second color is different from the first color.

In some cases, the causing display, on the user interface, of the atleast a portion of the first time-stamped events set and of the at leasta portion of the second time-stamped events set in the interleaved andvisually distinct display format comprises causing display, on the userinterface, of the at least a portion of the first time-stamped eventsset in a left aligned format, and causing display, on the userinterface, of the at least a portion of the second time-stamped eventsset in a right aligned format.

In some cases, the at least a portion of the first time-stamped eventsset comprises the first time-stamped events set, where the at least aportion of the second time-stamped events set comprises the secondtime-stamped events set. In some cases, the first time-stamped eventsset represents data from a first system, where the second time-stampedevents set represents data from a second system. In some cases, thefirst time-stamped events set represents raw log data from a firstsystem, where the second time-stamped events set represents raw log datafrom a second system. In some cases, the first time-stamped events setcomprises a first subset of a time-stamped events set, and the secondtime-stamped events set comprises a second subset of the time-stampedevents set, where each time-stamped event of the first time-stampedevents set has a first field value for a particular field, where eachtime-stamped event of the second time-stamped events set has a secondfield value for the particular field, and where the first field value isdifferent from the second field value.

In some cases, the first time-stamped events set comprises a firstsubset of a time-stamped events set, where the second time-stampedevents set comprises a second subset of the time-stamped events set, andeach time-stamped event of the first time-stamped events set has a firstfield value for a particular field, where each time-stamped event of thesecond time-stamped events set has a second field value for theparticular field, where the first field value is different from thesecond field value, and where the particular field is a host field, asource field, a source type field, a timestamp field, or any otherfield.

In some cases, the data from the at least a portion of the firsttime-stamped events set is interleaved with the data from the at least aportion of the second time-stamped events set using timestamps of thedata from the at least a portion of the first time-stamped events setand timestamps of the data from the at least a portion of the secondtime-stamped events set, where the data from the at least a portion ofthe first time-stamped events set and the data from the at least aportion of the second time-stamped events set is presented inchronological order based on the timestamps.

In some cases, the at least a portion of the first time-stamped eventsset represents a result of a first search query applying the latebinding schema to the source data, and where the at least a portion ofthe second time-stamped events set represents a result of a secondsearch query applying the late binding schema to the source data.

In some cases, the at least a portion of the first time-stamped eventsset represents output of a first data processing pipeline, where the atleast a portion of the second time-stamped events set represents outputof a second data processing pipeline.

In some cases, the at least a portion of the first time-stamped eventsset represents a column of data from a first data table, where the atleast a portion of the second time-stamped events set represents acolumn of data from a second data table or another column of data fromthe first data table.

In some cases, the receiving comprises receiving a first request torepresent the at least a portion of the first time-stamped events set asa first tab on the user interface, receiving a second request torepresent the at least a portion of the second time-stamped events setas a second tab on the user interface, and receiving a request to joindata represented by the first and second tabs in the interleaved andvisually distinct display format.

In some cases, the receiving comprises receiving a request to displaythe at least a portion of the first time-stamped events set, the atleast a portion of the second time-stamped events set, and at least aportion of a third time-stamped events set in the interleaved andvisually distinct display format, and the causing comprises causingdisplay, on the user interface, the at least a portion of the firsttime-stamped events set, the at least a portion of the secondtime-stamped events set, and the at least a portion of the thirdtime-stamped events set in the interleaved and visually distinct displayformat, where a source for the at least a portion of the thirdtime-stamped events set represents a third participant in theinterleaved and visually distinct display format.

In some cases, the at least a portion of the first time-stamped eventsset represents raw log data from a first system, and each time-stampedevent of the at least a portion of the second time-stamped events sethas a first field value for a particular field.

In some cases, the at least a portion of the first time-stamped eventsset changes based upon time, and the at least a portion of the secondtime-stamped events set changes based upon time.

In some cases, a format of the at least a portion of the firsttime-stamped events set changes based upon time, and a format of the atleast a portion of the second time-stamped events set changes based upontime.

In some cases, the at least a portion of the first time-stamped eventsset changes based upon a first event threshold value, and the at least aportion of the second time-stamped events set changes based upon asecond event threshold value.

In some cases, a format of the at least a portion of the firsttime-stamped events set changes based upon a first event thresholdvalue, and a format of the at least a portion of the second time-stampedevents set changes based upon a second event threshold value.

In some cases, the at least a portion of the first time-stamped eventsset and the at least a portion of the second time-stamped events setcomprise one or more metadata fields.

In some cases, the first time-stamped events set comprises a firstsubset of a time-stamped events set, the second time-stamped events setcomprises a second subset of the time-stamped events set, eachtime-stamped event of the first time-stamped events set has a firstmetadata field value for a particular metadata field, each time-stampedevent of the second time-stamped events set has a second metadata fieldvalue for the particular field metadata field, and the first metadatafield value is different from the second metadata field value.

In some cases, the first time-stamped events set comprises a firstsubset of a time-stamped events set, the second time-stamped events setcomprises a second subset of the time-stamped events set, eachtime-stamped event of the first time-stamped events set has a firstfield value for a particular field, each time-stamped event of thesecond time-stamped events set has a second field value for theparticular field, the particular field is defined by one or moreextraction rules, and the first field value is different from the secondfield value.

FIG. 21 presents a flowchart illustrating suggested field extraction inaccordance with the disclosed embodiments. At block 2102, a systemautomatically determines an extraction rule capable of extracting afield-label value pair within selected one or more values. For example,based on a selection by a user of first one or more values of one ormore events displayed in a graphical interface, an extraction rule isautomatically determined that is capable of extracting a fieldlabel-value pair at least partially within at least the selected one ormore values.

At block 2104, display is caused on an option corresponding to thedetermined extraction rule in a graphical interface. For example,display is caused of an option corresponding to the determinedextraction rule in the graphical interface.

At block 2106, display is caused on second values of field label-valuepairs extracted from events using the extraction rule. For example,based on the user selecting the option in the graphical interface,display is caused of second one or more values of one or more fieldlabel-value pairs extracted from the one or more events using theextraction rule.

In some cases, the one or more events are displayed in a table format,and a value of the first one or more values is selected by the userselecting a cell in the table format, the cell comprising the value. Insome cases, the one or more events are displayed in a table format, andthe one or more values are selected by the user selecting a column inthe table format, the column comprising a plurality of the first one ormore values.

In some cases, the displayed one or more field label-value pairs includethe field label-value pair.

In some cases, the automatically determining the extraction rulecomprises automatically generating the extraction rule from the selectedfirst one or more values.

In some cases, based on the user selecting the option in the graphicalinterface, the second one or more values are caused to be assigned to afield of the one or more events.

In some cases, based on the selection by the user of the first one ormore values of the one or more events displayed in the graphicalinterface, the determined extraction rule is caused to be saved to aconfiguration file for a future field extraction that is used to apply alate binding schema to a set of events.

In some cases, the determined extraction rule comprises a regularexpression.

In some cases, the automatically determining the extraction rulecomprises detecting a first text portion as being separated by one ormore designated demarcating characters from a second text portion in theselected first one or more values.

In some cases, the automatically determining the extraction rulecomprises detecting one or more designated demarcating characters in theselected first one or more values.

In some cases, the selected first one or more values comprise a selectedportion of a textual representation of a value of the one or moreevents.

In some cases, the second one or more values of one or more fieldlabel-value pairs are extracted from the one or more events using theextraction rule as part of a command that automatically extracts allidentified field label-value pairs in a set of data items of the one ormore event, each field label-value pair comprising a field label and avalue, wherein one of the field label-value pairs is identified for eachfirst text portion separated by one or more designated demarcatingcharacters from a second text portion in the set of data items, thefirst text portion matching the field label and the second text portionbeing used as the value.

In some cases, a late binding schema is applied to the one or moreevents using a plurality of extraction rules that comprise thedetermined extraction rule based on the user selecting the option in thegraphical interface.

In some cases, the determined extraction rule comprises instructionsdefining identification and extraction of a data item of a field and afield label corresponding to the data item from data, the defined fieldlabel matching a field label of the field label-value pair.

In some cases, the causing display of the second one or more values ofthe one or more field label-value pairs extracted from the one or moreevents using the extraction rule causes the second one or more values tobe displayed with the one or more events in a table format.

As can be understood, implementations of the present disclosure providefor various approaches to information analysis and management especiallyfor machine data. The present invention has been described in relationto particular embodiments, which are intended in all respects to beillustrative rather than restrictive. Alternative embodiments willbecome apparent to those of ordinary skill in the art to which thepresent invention pertains without departing from its scope.

From the foregoing, it will be seen that this invention is one welladapted to attain all the ends and objects set forth above, togetherwith other advantages which are obvious and inherent to the system andmethod. It will be understood that certain features and subcombinationsare of utility and may be employed without reference to other featuresand subcombinations. This is contemplated by and is within the scope ofthe claims.

The invention claimed is:
 1. A computer-implemented method comprising:causing display of a set of events that are search results of a searchquery represented as a search string that specifies a plurality ofcommands, each event corresponding to a portion of raw machine dataassociated with a timestamp, the display of the set of events being in atable format that includes: one or more columns, each column comprisingdata items of an event attribute, the data items being of the set ofevents; and a plurality of rows forming cells with the one or morecolumns, each cell comprising one or more of the data items of the eventattribute of a corresponding column, wherein each cell is selectable bya user; based on a user selection of one or more of the cells in thetable format: causing display of a list of options corresponding to theselected one or more cells; and causing one or more commands to be addedto the search query sequentially after the search string, wherein theone or more commands are based on an option that is selected from thelist of options and the event attribute corresponding to the selectedone or more cells.
 2. The computer-implemented method of claim 1,further comprising causing the selected option to be included in thedisplayed list of options based on a determination that at least one ofthe selected one or more cells is an empty cell.
 3. Thecomputer-implemented method of claim 1, further comprising causing theselected option to be included in the displayed list of options based ona determination that at least one of the one or more of the data itemsof at least one of the selected one or more cells is of a numeric datatype.
 4. The computer-implemented method of claim 1, further comprisingcausing the selected option to be included in the displayed list ofoptions based on a determination that at least one of the one or more ofthe data items of at least one of the selected one or more cells is of acategorical data type.
 5. The computer-implemented method of claim 1,further comprising causing the selected option to be included in thedisplayed list of options based on a determination that at least one ofthe one or more of the data items of at least one of the selected one ormore cells comprises the portion of raw machine data for at least one ofthe events.
 6. The computer-implemented method of claim 1, furthercomprising causing the selected option to be included in the displayedlist of options based on a determination that at least one of the one ormore of the data items of at least one of the selected one or more cellscomprises, for at least one of the events, the timestamp associated withthe portion of raw machine data.
 7. The computer-implemented method ofclaim 1, wherein the selected one or more cells comprise a firstselected cell and a second selected cell, and the selected option iscaused to be included in the displayed list of options based on adetermination that the first and second cells are in different columnsof the one or more columns.
 8. The computer-implemented method of claim1, further comprising causing the selected option to be included in thedisplayed list of options based on a determination that at least one ofthe one or more of the data items of at least one of the selected one ormore cells comprise a statistical value generated by one or morestatistical functions performed on values of data items of at least someof the set of events.
 9. The computer-implemented method of claim 1,further comprising causing the selected option to be included in thedisplayed list of options based on a determination that at least one ofthe one or more of the data items of at least one of the selected one ormore cells comprises multiple values.
 10. The computer-implementedmethod of claim 1, wherein the data items of the event attribute of thecorresponding column of at least one of the selected one or more cellseach comprise values of a field extracted from the set of events using acommon extraction rule.
 11. The computer-implemented method of claim 1,wherein the selected one or more cells is an individually selected cell.12. The computer-implemented method of claim 1, further comprisingcausing the selected option to be included in the displayed list ofoptions based on detection of at least one field label-value pair in theselected one or more cells.
 13. The computer-implemented method of claim1, further comprising causing the selected option to be generated atleast partially based on detection of at least one field label-valuepair in a subportion of text displayed in a cell of the selected one ormore cells.
 14. The computer-implemented method of claim 1, furthercomprising: causing a field label of a field label-value pair to bedetected in a subportion of text displayed in a cell of the selected oneor more cells; and causing the field label to be displayed in an optionin the displayed list of options.
 15. The computer-implemented method ofclaim 1, receiving one or more command elements of the one or morecommands entered into a form by the user, the option being displayed inthe list of options as the form.
 16. The computer-implemented method ofclaim 1, wherein one or more command elements of the one or morecommands include at least one value of the one or more of the data itemsfor each of the selected one or more cells.
 17. The computer-implementedmethod of claim comprising further based on the user selection, causingthe event attribute for each of the one or more of the data items ofeach of the selected one or more cells to be included as one or morecommand elements of the one or more commands.
 18. Thecomputer-implemented method of claim 1, comprising: further based on theuser selection: causing the search query comprising the added one ormore commands to be automatically executed; and causing the set ofevents displayed in the table format to be updated to correspond tosearch results of the executed search query comprising the added one ormore commands.
 19. The computer-implemented method of claim 1,comprising: further based on the user selection, causing a displayedrepresentation of the search query in the user interface to beautomatically updated to include a representation of the added one ormore commands.
 20. The computer-implemented method of claim 1,comprising: further based on the user selection, causing the searchquery comprising the added one or more commands to be executed, theexecuting applying a late-binding schema to events using one or moreextraction rules defining one or more fields for the set of events. 21.The computer-implemented method of claim 1, wherein the one or morecommands cause extraction of one or more field label-values pairs fromat least the data items of each of the selected one or more cells andcause the field label-value pairs to be associated with at least oneevent of the set of events.
 22. The computer-implemented method of claim1, further comprising causing display of the option as a form in thedisplayed list of options, the form comprising at least one form elementoperable to enter one or more command elements into the one or morecommands to be added to the search query; and after adding the one ormore commands to the search query using the form, causing display of areproduction of the form, the reproduction comprising the one or morecommand elements and being user operable to modify the one or morecommands that were added to the search query.
 23. Thecomputer-implemented method of claim 1, comprising: further based on theuser selecting the one or more of the cells in the table format, causinga command entry that represents the one or more commands to beautomatically added to a displayed list of command entries in the searchinterface, each of the command entries respectively representing one ormore commands of a plurality of commands of the search query, the listof command entries being displayed in a sequence corresponding to theplurality of commands in the search query.
 24. The computer-implementedmethod of claim 1, wherein the one or more commands are of a pipelinedsearch language in which a command of the search query produces anoutput from an input of the command, and the input is an output of aprior command of the search query.
 25. The computer-implemented methodof claim 1, wherein the search query comprises an input search query andan additional search query that extends the input search query, whereinthe table format is in a search interface that restricts a user frommodifying the input search query.
 26. The computer-implemented method ofclaim 1, wherein the display of the set of events in the table format isin a search screen, and the causing one or more commands to be added tothe search query causes the table format in the displayed search screento be automatically updated to add a new column that represents a newfield extracted from the events by the one or more commands added to thesearch query.
 27. The computer-implemented method of claim 1, whereinthe one or more commands includes a command of a plurality ofpredetermined commands of a search language, the option, when selected:causing a command identifier of the command to be added to the searchquery independent of which of the one or more of the cells was userselected to cause the display of the list of options; and causingarguments of the command to be added to the search query that arecomposed based on which of the one or more of the cells was userselected to cause the display of the list of options.
 28. Acomputer-implemented system for searching data, the system comprising:one or more data processors; and one or more computer-readable storagemedia containing instructions which when executed on the one or moredata processors, cause the one or more processors to perform operationsincluding: causing display of a set of events that are search results ofa search query represented as a search string that specifies a pluralityof commands, each event corresponding to a portion of raw machine dataassociated with a timestamp, the display of the set of events being in atable format that includes: one or more columns, each column comprisingdata items of an event attribute, the data items being of the set ofevents; and a plurality of rows forming cells with the one or morecolumns, each cell comprising one or more of the data items of the eventattribute of a corresponding column, wherein each cell is selectable bya user; based on a user selection of one or more of the cells in thetable format: causing display of a list of options corresponding to theselected one or more cells; and causing one or more commands to be addedto the search query sequentially after the search string, wherein theone or more commands are based on an option that is selected from thelist of options and the event attribute corresponding to the selectedone or more cells.
 29. The system of claim 28, wherein the operationsfurther comprise receiving one or more command elements of the one ormore commands entered into a form by the user, the option beingdisplayed in the list of options as the form.
 30. The system of claim28, wherein the operations comprise: further based on the user selectingthe one or more of the cells in the table format selection: causing thesearch query comprising the added one or more commands to beautomatically executed; and causing the set of events displayed in thetable format to be updated to correspond to search results of theexecuted search query comprising the added one or more commands.
 31. Thesystem of claim 28, wherein the display of the set of events in thetable format is in a search screen, and the causing one or more commandsto be added to the search query causes the table format in the displayedsearch screen to be automatically updated to add a new column thatrepresents a new field extracted from the events by the one or morecommands added to the search query.
 32. The system of claim 28, whereinthe one or more commands includes a command of a plurality ofpredetermined commands of a search language, the option, when selected:causing a command identifier of the command to be added to the searchquery independent of which of the one or more of the cells was userselected to cause the display of the list of options; and causingarguments of the command to be added to the search query that arecomposed based on which of the one or more of the cells was userselected to cause the display of the list of options.
 33. One or morenon-transitory computer-storage media storing computer-useableinstructions that, when executed by at least one computing device, causethe at least one computing device to perform a method, the methodcomprising: causing display of a set of events that are search resultsof a search query represented as a search string that specifies aplurality of commands, each event corresponding to a portion of rawmachine data associated with a timestamp, the display of the set ofevents being in a table format that includes: one or more columns, eachcolumn comprising data items of an event attribute, the data items beingof the set of events; and a plurality of rows forming cells with the oneor more columns, each cell comprising one or more of the data items ofthe event attribute of a corresponding column, wherein each cell isselectable by a user; based on a user selection of one or more of thecells in the table format: causing display of a list of optionscorresponding to the selected one or more cells; and causing one or morecommands to be added to the search query sequentially after the searchstring, wherein the one or more commands are based on an option that isselected from the list of options and the event attribute correspondingto the selected one or more cells.
 34. The one or more computer-storagemedia of claim 33, the method further comprising: further based on theuser selecting the one or more of the cells in the table formatselection: causing the search query comprising the added one or morecommands to be automatically executed; and causing the set of eventsdisplayed in the table format to be updated to correspond to searchresults of the executed search query comprising the added one or morecommands.
 35. The one or more computer-storage media of claim 34,further comprising accessing the events in a data store to produce thesearch results of the search query, wherein each event in the data storeincludes the portion of raw machine data of that event.
 36. The one ormore computer-storage media of claim 33, wherein the added one or morecommands cause search results of the search query to be produced fromintermediate search results produced by the plurality of commands. 37.The one or more computer-storage media of claim 33, wherein a column ofthe one or more columns corresponds to a single field and each cell of aplurality of cells in the column comprises a value of the single fieldfor a different event of the set of events.
 38. The one or morecomputer-storage media of claim 33, wherein each row of the plurality ofrows represents a different event of the set of events.
 39. The one ormore computer-storage media of claim 33, wherein the display of the setof events in the table format is in a search screen, and the causing oneor more commands to be added to the search query causes the table formatin the displayed search screen to be automatically updated to add a newcolumn that represents a new field extracted from the events by the oneor more commands added to the search query.
 40. The one or morecomputer-storage media of claim 33, wherein the one or more commandsincludes a command of a plurality of predetermined commands of a searchlanguage, the option, when selected: causing a command identifier of thecommand to be added to the search query independent of which of the oneor more of the cells was user selected to cause the display of the listof options; and causing arguments of the command to be added to thesearch query that are composed based on which of the one or more of thecells was user selected to cause the display of the list of options.